Spring Security注销

Question

我在Spring Security上遇到了麻烦。我可以登录但不能注销（至少不是按预期）。

登录后，我将被重定向到/secure/home.xhtml

这里是迄今为止的代码：

索引.xhtm

<form method="POST" id="loginForm" action="#{request.contextPath}/j_spring_security_check" class="form-signin" autocomplete="off">
            <div class="form-group">
                <label for="username" class="control-label">#{bundle["login.username"]}</label>
                <input type="text" name="username" id="username" class="input-block-level form-control"
                       placeholder="#{bundle['label.username']}" required="true" tabindex="1" />
                <span class="help-block"></span>
            </div>
            <div class="form-group">
                <label for="password" class="control-label">#{bundle["login.password"]}</label>
                <input type="password" class="input-block-level form-control" name="password" id="password" tabindex="2"
                       placeholder="#{bundle['label.password']}" required="true" />
                <span class="help-block"></span>
            </div>
            <button type="submit" tabindex="3" class="btn btn-success btn-block">#{bundle["login.action"]}</button>
            <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
        </form>

spring-security.xhtml， http conf

<security:http use-expressions="true" >
        <security:intercept-url pattern="/secure/**" access="hasAnyRole('USER','ADMIN')" />
        <security:intercept-url pattern="/admin/**" access="hasRole('ADMIN')" />
        <!--<security:access-denied-handler error-page="/404.xhtml" />-->
        <security:form-login 
            login-page="/index.xhtml" 
            default-target-url="/secure/home.xhtml" 
            authentication-failure-url="/index.xhtml?error"
            username-parameter="username" 
            password-parameter="password" />
        <security:logout logout-url="/logout" logout-success-url="/index.xhtml?logout" invalidate-session="true" delete-cookies="JSESSIONID" />
        <security:csrf />
    </security:http>

这是我试图在stackoverflow上实现有关其他答案的注销的方式：

<a href="#{request.contextPath}/logout">logout</a>
                    <h:outputLink value="#{request.contextPath}/logout">Logout</h:outputLink>

但这两个链接都不起作用。我得到了404。我还读到你应该替换请求。带有pageContext.request的contextPath。contextPath，但这也不起作用。（不是localhost:8080/myContext/logout，而是链接将我重定向到localhost:8080/logout）

一个教程告诉我，注销也可以通过以下方式实现：

<form method="POST" id="loginForm" action="#{request.contextPath}/logout" class="form-signin" autocomplete="off">
                        <button type="submit" tabindex="3" class="btn btn-success btn-block">#{bundle["logout.action"]}</button>
                        <input type="hidden" name="#{_csrf.parameterName}" value="#{_csrf.token}" />
                    </form>

起初，它似乎解决了我的问题，但在向安全部分添加更多页面后，例如“profile.xhtml ”,我遇到了不希望的行为，即在页面加载后我被注销。因此，如果我在home.xhtml中添加如上所示的注销表单，即使我没有点击logout，我也似乎被注销了。如果我刷新页面，即使我没有点击注销，我也会被重定向到index.xhtml(登录)。因此，如果我点击profile.xhtml的链接，我自然会被重定向到index.xhtml，因为spring认为我注销了。没有这个表单，我可以保持登录，但是不能注销！真是一团糟！

啊，如果我点击表单上的注销按钮，我得到以下错误：

HTTP Status 403 - Expected CSRF token not found. Has your session expired?

type Status report

messageExpected CSRF token not found. Has your session expired?

descriptionAccess to the specified resource has been forbidden.

我真的不知道我的配置有什么问题：（！

这是我的网站.xml：

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
         version="3.1">
    <context-param>
        <param-name>javax.faces.PROJECT_STAGE</param-name>
        <param-value>Development</param-value>
    </context-param>
    <context-param>
        <param-name>javax.faces.FACELETS_SKIP_COMMENTS</param-name>
        <param-value>true</param-value>
    </context-param>
    <context-param>
        <param-name>javax.faces.INTERPRET_EMPTY_STRING_SUBMITTED_VALUES_AS_NULL</param-name>
        <param-value>true</param-value>
    </context-param>
    <context-param>
        <param-name>javax.servlet.jsp.jstl.fmt.localizationContext</param-name>
        <param-value>messages</param-value>
    </context-param>
    <context-param>
        <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
        <param-value>server</param-value>
    </context-param>
    <context-param>
        <param-name>javax.faces.DEFAULT_SUFFIX</param-name>
        <param-value>.xhtml</param-value>
    </context-param> 
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            classpath:/application-context.xml
            classpath:/application-security.xml
        </param-value>
    </context-param>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
    <listener>
        <listener-class>com.sun.faces.config.ConfigureListener</listener-class>
    </listener>

    <!-- Predefined pages -->
    <welcome-file-list>
        <welcome-file>index.xhtml</welcome-file>
    </welcome-file-list>
    <!--    <error-page>
        <error-code>403</error-code>
        <location>/error.xhtml</location>
    </error-page>-->
    <error-page>
        <error-code>404</error-code>
        <location>/404.xhtml</location>
    </error-page>
    <error-page>
        <error-code>500</error-code>
        <location>/error.xhtml</location>
    </error-page>
    <error-page>
        <exception-type>javax.faces.application.ServletException</exception-type>
        <location>/index.xhtml</location>
    </error-page>
    <error-page>
        <exception-type>java.lang.Exception</exception-type>
        <location>/error.xhtml</location>
    </error-page>

    <session-config>
        <session-timeout>30</session-timeout>
    </session-config>

    <servlet>
        <servlet-name>Faces Servlet</servlet-name>
        <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>Faces Servlet</servlet-name>
        <url-pattern>*.xhtml</url-pattern>
    </servlet-mapping>

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/logout</url-pattern>
    </filter-mapping>

    <!-- MIME TYPES -->
    <mime-mapping>
        <extension>css</extension>
        <mime-type>text/css</mime-type>
    </mime-mapping>
    <mime-mapping>  
        <extension>eot</extension>  
        <mime-type>application/x-font-eot</mime-type>  
    </mime-mapping>
    <mime-mapping>
        <extension>js</extension>
        <mime-type>text/javascript</mime-type>
    </mime-mapping>
    <mime-mapping>
        <extension>latex</extension>
        <mime-type>application/x-latex</mime-type>
    </mime-mapping>
    <mime-mapping>  
        <extension>otf</extension>  
        <mime-type>application/x-font-opentype</mime-type>  
    </mime-mapping>   
    <mime-mapping>
        <extension>roff</extension>
        <mime-type>application/x-troff</mime-type>
    </mime-mapping>
    <mime-mapping>  
        <extension>svg</extension>  
        <mime-type>application/svg+xml</mime-type>  
    </mime-mapping>
    <mime-mapping>  
        <extension>ttf</extension>  
        <mime-type>application/x-font-ttf</mime-type>  
    </mime-mapping>
    <mime-mapping>  
        <extension>woff</extension>  
        <mime-type>application/x-font-woff</mime-type>  
    </mime-mapping> 
    <mime-mapping>  
        <extension>woff2</extension>  
        <mime-type>application/x-font-woff2</mime-type>  
    </mime-mapping>
</web-app>

使用GlassFish 4.1、spring framework版本4.1.2.RELEASE和spring security版本3.2.5.RELEASE

我将不胜感激每一个答案。此错误已经花了两天时间，没有任何解决方案:(

Answer 1

使用Spring url aglig或jstl url aglib写下您的url。这篇文章很适合学习Spring安全配置

Answer 2

您在启用了CRLF防护。

您可以尝试通过将其添加到您的表单来支持CRLF：

<input type="hidden"
    name="${_csrf.parameterName}"
    value="${_csrf.token}"/>

如果这不起作用，您可以删除CSRF，尽管这不是建议的。

更多信息：http://docs.spring.io/spring-security/site/docs/3.2.x/reference/htmlsingle/#csrf