当发生超时后调用Servlet方法（控制器）时，Spring Security 3.1重定向到login不起作用

Question

问题是类似的：Spring Security 3.1重定向到登录不起作用

我将Spring3.1与Spring Mvc和Spring Security一起使用。

这里是app-security-config。

<security:http  auto-config="true" use-expressions="true">
    <security:form-login login-page="/login.jsp" 
                    login-processing-url="/j_spring_security_check" 
                    default-target-url="/pages/index.jsp"
                    always-use-default-target="true"
                    authentication-failure-url="/login.jsp?login_error=1"/>
                    <security:access-denied-handler ref="accessDeniedHandler"/>

    <!--  Session Invalida-->
    <security:logout invalidate-session="true" logout-success-url="/login.jsp" delete-cookies="JSESSIONID" />

    <!--  Interceptadores -->
    <!-- security:intercept-url pattern="/expire.jsp*" filters="none"/-->
    <!-- security:intercept-url pattern="/login.jsp*" access="ROLE_ANONYMOUS" requires-channel="https"/-->

    <security:intercept-url pattern="/expire.jsp" access="permitAll" />
    <security:intercept-url pattern="/AccessDenied.jsp*" access="permitAll" />
    <security:intercept-url pattern="/scripts/*" access="permitAll" />
    <security:intercept-url pattern="/styles/*" access="permitAll" />
    <security:intercept-url pattern="/images/*" access="permitAll" />
    <security:intercept-url pattern="/login.jsp" access="permitAll" requires-channel="https"/>
    <security:intercept-url pattern="/pages/**" access="hasAnyRole(${role.autenticated})"  requires-channel="https"/>
    <security:http-basic/>

    <!--  Establece maximas sesiones para un usuarios -->
    <security:session-management session-fixation-protection="none" >
       <security:concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
    </security:session-management>         

    <!--  Establece maximas sesiones para un usuarios -->
    <!-- security:session-management invalid-session-url="/expire.jsp"  session-fixation-protection="none" >
       <security:concurrency-control max-sessions="1" error-if-maximum-exceeded="true" expired-url="/expire.jsp"/>
    </security:session-management-->    

    <!-- security:session-management invalid-session-url="/login.jsp?login_error=2" session-authentication-error-url="/login.jsp?login_error=3" session-fixation-protection="none" >
       <security:concurrency-control max-sessions="1" error-if-maximum-exceeded="true" expired-url="/login.jsp?login_error=4"/>
    </security:session-management-->   

    <security:port-mappings>
        <security:port-mapping http='8080' https="8443"/>
    </security:port-mappings>

</security:http>


<beans:bean id="accessDeniedHandler" class="ar.com.firstdata.upploader.web.mvc.controller.AccessDeniedController">
    <beans:property name="accessDeniedUrl" value="/AccessDenied.jsp"> </beans:property>
</beans:bean> 

<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>classpath:META-INF/spring/*-config.xml</param-value>
</context-param>

<jsp-config>
    <taglib>
        <taglib-uri>sitemesh-page</taglib-uri>
        <taglib-location>/tld/sitemesh-page.tld</taglib-location>
    </taglib>

    <taglib>
        <taglib-uri>sitemesh-decorator</taglib-uri>
        <taglib-location>/tld/sitemesh-decorator.tld</taglib-location>
    </taglib>

    <taglib>
        <taglib-uri>/spring</taglib-uri>
        <taglib-location>/META-INF/spring.tld</taglib-location>
    </taglib>
</jsp-config>

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>REQUEST</dispatcher>
    <dispatcher>FORWARD</dispatcher>
</filter-mapping>

<listener>
    <listener-class>
        org.springframework.web.context.ContextLoaderListener
    </listener-class>
</listener>

<!-- SiteMesh -->
<filter>
    <filter-name>sitemesh</filter-name>
    <filter-class>com.opensymphony.sitemesh.webapp.SiteMeshFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>sitemesh</filter-name>
    <url-pattern>*.html</url-pattern>
</filter-mapping>
<filter-mapping>
    <filter-name>sitemesh</filter-name>
    <url-pattern>*.htm</url-pattern>
</filter-mapping>
<filter-mapping>
    <filter-name>sitemesh</filter-name>
    <url-pattern>*.jsp</url-pattern>
</filter-mapping>

<listener>
    <listener-class>
        org.springframework.security.web.session.HttpSessionEventPublisher
    </listener-class>
</listener>

<servlet>
    <servlet-name>dispatcher</servlet-name>
    <servlet-class>
        org.springframework.web.servlet.DispatcherServlet
    </servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>

<session-config>
    <session-timeout>1</session-timeout>
</session-config>

<servlet-mapping>
    <servlet-name>dispatcher</servlet-name>
    <url-pattern>*.app</url-pattern>
</servlet-mapping>

<welcome-file-list>
    <welcome-file>login.jsp</welcome-file>
</welcome-file-list>

<bean id="urlMapping" class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping">
    <property name="mappings">
        <props>
            <prop key="/pages/findConfData.app">configurationController</prop>
            <prop key="/pages/readLoadXML.app">configurationController</prop>
            <prop key="/pages/addElementToList.app">configurationController</prop>
            <prop key="/pages/eraseElementToList.app">configurationController</prop>
            <prop key="/pages/persistXMLfiletransfer.app">configurationController</prop>
            <prop key="/pages/findLoggedUser.app">configurationController</prop>
        </props>            
    </property>
</bean>

<session-config>
    <session-timeout>1</session-timeout>
</session-config>

<prop key="/pages/eraseElementToList.app">configurationController</prop>

@RequestMapping(method = RequestMethod.POST)
public final ModelAndView eraseElementToList(HttpServletRequest request,    
HttpServletResponse response) throws Exception {

我在日志中得到一个ActionDenied异常，就这样...没有将我重定向到登录页面。

Answer 1

这里最有可能的解释是，您有一个SpringExceptionHandler，它会捕获AccessDeniedException并阻止Spring Security性对其起作用。如果您在某个地方使用安全注释，这是一个相当常见的问题（尽管您在问题中没有提到这一点）。

另外，从stacktrace中应该可以清楚地看到，它提到了Spring Security没有处理它的异常（始终发布stacktrace）。另外，请更仔细地重新检查日志，以区分这两种情况。如果您看到“重定向到身份验证入口点”，那么这意味着Spring Security正在接收异常，您应该看到登录页面。如果使用异常处理程序，您将不会看到这一点。

如果这是问题所在，您可以使@exceptionhandler注释更加具体，这样它们就不会捕获此异常，或者您可以创建一个特定的@exceptionhandler(AccessDeniedException.class)注释并简单地在其中重新抛出异常。