Spring Security基本身份验证只发生一次

Question

最近，我对REST服务使用Spring Security basic身份验证。

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:security="http://www.springframework.org/schema/security"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/security
       http://www.springframework.org/schema/security/spring-security.xsd">

    <security:http pattern="/rest/**" create-session="never" use-expressions="true">
        <security:http-basic />
        <security:intercept-url pattern="/rest/auth/**" access="isAuthenticated()"/>
    </security:http>

    <security:authentication-manager alias="authenticationManager">
        <security:authentication-provider>
            <security:user-service>
                <security:user name="admin" password="admin" authorities="ROLE_ADMIN"/>
            </security:user-service>
        </security:authentication-provider>
        <security:authentication-provider user-service-ref="userDetailsService">
            <security:password-encoder hash="sha-256" />
        </security:authentication-provider>
    </security:authentication-manager>

    <security:global-method-security jsr250-annotations="enabled" pre-post-annotations="enabled"/>
</beans>

<springframework.version>4.1.0.RELEASE</springframework.version>
<spring.security.version>3.2.5.RELEASE</spring.security.version>

我希望浏览器总是提示我基本身份验证，因为我将create-session属性设置为never。

我是不是漏掉了什么？

Answer 1

浏览器缓存凭据。有时清除缓存无济于事。唯一可靠的方法如何伪造它是使用Chrome的隐姓埋名窗口(CTRL+N)。但每个隐姓埋名窗口都有一个提示。所以当你想再次进入它们时，你需要新的隐姓埋名窗口。

这是我找到的手动测试基本身份验证的唯一方法。