基本Spring Security错误

Question

我有一个Spring应用程序，我所要做的就是向它添加Spring Security提供的所有默认标头。我的web.xml更改如下：

<!-- Loads Spring Security config file -->
<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>
        /WEB-INF/spring-security.xml
    </param-value>
</context-param>

<!-- Spring Security -->
<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy
    </filter-class>
</filter>

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

我的Spring安全.xml如下：

<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.2.xsd">

    <http auto-config="true">
        <headers />
    </http>

</beans:beans> 

我在启动时看到以下错误

原因：org.springframework.beans.factory。BeanCreationException:创建名为“org.springframework.security.web的bean时出错。”。DefaultSecurityFilterChain#0“：无法解析对bean”org.springframework.security.web.authentication“的引用。使用键[4]设置构造函数参数时，UsernamePasswordAuthenticationFilter#0'；嵌套异常是org.springframework.beans.factory。BeanCreationException:创建名为“org.springframework.security.web.authentication的bean时出错。”。UsernamePasswordAuthenticationFilter#0“：无法解析对bean”org.springframework.security.authentication“的引用。设置bean属性'authenticationManager'时，ProviderManager#0'；嵌套异常是org.springframework.beans.factory。BeanCreationException:创建名为“org.springframework.security.authentication”的bean时出错。ProviderManager#0“：无法解析对bean”org.springframework.security.config.authentication“的引用。设置构造函数参数时AuthenticationManagerFactoryBean#0'；嵌套异常是org.springframework.beans.factory。BeanCreationException:创建名为“org.springframework.security.config.authentication”的bean时出错。AuthenticationManagerFactoryBean#0'：FactoryBean在创建对象时引发异常；嵌套异常是org.springframework.beans.factory。NoSuchBeanDefinitionException：没有名为“org.springframework.security”的bean。authenticationManager’已定义：您是否忘记向配置中添加gobal元素（带有子元素）？或者，您可以在和元素上使用身份验证管理器ref属性。

Answer 1

在SecurityConfig java类中尝试此操作以禁用跨站点请求伪造（CSRF）。默认情况下启用：

   @EnableWebSecurity
    @Configuration
    public class SecurityConfig extends WebSecurityConfigurerAdapter {
    ...
    @Override
    protected void configure(HttpSecurity http) throws Exception {
       http.csrf().disable();
       //You can continue extending this method call . e.g. calling 
       //authorizeRequests()
       http.headers().xssProtection();

        }
    }

Answer 2

您需要给它一些东西来验证用户。尝试添加

<user-service>
        <user name="user" password="password" authorities="ROLE_USER" />
</user-service>

对于您的安全 xml，请参阅此处的示例。