将基于xml的全面spring security配置(2.0.4)迁移到基于java的配置（4.2）中的问题

Question

在Spring security 2.0.4中，声明如下所示，过滤器的位置也在各个bean声明中声明.....

旧的security.xml

<sec:http session-fixation-protection="migrateSession">
    <sec:intercept-url pattern="/login.hm*" filters="none" requires-channel="https" />
    <sec:intercept-url pattern="/services/**" filters="none" requires-channel="https"/>
    <sec:intercept-url pattern="/widget/**" filters="none" requires-channel="https" />
    <sec:intercept-url pattern="/istore/theme/**" filters="none" requires-channel="https"/>
    <sec:intercept-url pattern="/logout.hm*" filters="none" requires-channel="https" />
    <sec:intercept-url pattern="/mstore/theme/**" filters="none" requires-channel="https"/>
    <sec:intercept-url pattern="/istore/history*" access="ROLE_UU" requires-channel="https"/>
    <sec:intercept-url pattern="/istore/consumer_goods*" access="ROLE_UU" requires-channel="https"/>
    <sec:intercept-url pattern="/istore/electronics*" access="ROLE_UU" requires-channel="https"/>
    <sec:intercept-url pattern="/istore/accessories*" access="ROLE_UU" requires-channel="https"/>
    <sec:intercept-url pattern="/istore/reward_redemption*" access="ROLE_UU" requires-channel="https"/>
    <sec:intercept-url pattern="/istore/**" access="ROLE_UU,ROLE_SSS" requires-channel="https"/>
    <sec:form-login
            login-page="${login.url}"
            login-processing-url="${login.processing.url}"
            default-target-url="${setuppassword.page.url}"
            authentication-failure-url="${login.failure.url}" always-use-default-target="false" />
</sec:http>

Spring Security：如何排除某些资源？

https://www.baeldung.com/security-none-filters-non-access-permitall

null

INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: 'characterEncodingFilter' to: [/*]
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: 'hiddenHttpMethodFilter' to: [/*]
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: 'httpPutFormContentFilter' to: [/*]
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: 'requestContextFilter' to: [/*]
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: 'springSecurityFilterChain' to: [/*]
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: 'sitemesh' to urls: [*.hm]
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: 'CustomSecurityHeaderFilter' to urls: []
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: 'HttpOnlyCookieFilter' to urls: [*.hm]
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: 'ValidatorFilter' to urls: [*.hm]
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: 'org.springframework.security.filterChainProxy' to: [/*]
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter:'org.springframework.security.web.access.intercept.FilterSecurityInterceptor#0' to: [/*]
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: 'org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter#0' to: [/*]
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: 'httpOnlyCookieFilter' to: [/*]
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: 'logoutFilter' to: [/*]
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: 'iStoreFilter' to: [/*]
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: 'loginFilter' to: [/*]
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: 'preLoginFilter' to: [/*]
INFO 78928 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean   : Mapping filter: '_formLoginFilter' to: [/*]

Answer 1

我以前问过下面的问题，因为没有重点而被删除了，所以我请求它自己来回答，因为我觉得它可能对其他人也有用。

https://stackoverflow.com/questions/60221667/custom-filters-by-spring-and-mapped-to-even-after-specify-se

对于Spring security迁移到版本3&以上版本,您可以简单地扩展WebSecurityConfigurerAdapter并覆盖使用基于JAVA配置的构建器模式的方法,

1. 第一个添加URL模式，包括角色、身份验证提供程序、身份验证处理程序（成功/失败）、注销、注销处理程序、会话管理配置、具有定义位置的筛选器集等。

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/istore/link.jsp").hasAnyAuthority("UU", "SSS")
                .antMatchers("/istore/**/*.jsp").hasAuthority("RESTRICT")
                .antMatchers("/mstore/**/*.jsp").hasAuthority("RESTRICT")
                .antMatchers("/istore/card*").hasAuthority("UU")
                .antMatchers("/istore/history*").hasAuthority("UU")
                .antMatchers("/istore/orders*").hasAuthority("UU")
                .antMatchers("/istore/consumer_goods*").hasAuthority("UU")
                .antMatchers("/istore/electronics*").hasAuthority("UU")
                .antMatchers("/istore/reward_redemption*").hasAuthority("UU")
                .antMatchers("/istore/accessories*").hasAuthority("UU")
                .antMatchers("/istore/privelege_card*").hasAuthority("UU")
                .antMatchers("/istore/profile*").hasAuthority("UU")
                .antMatchers("/istore/reward_redemption*").hasAuthority("UU")
                .antMatchers("/istore/addresses*").hasAuthority("UU")
                .antMatchers("/istore/**").hasAuthority("UU")
                .and()
                .formLogin()
                .loginPage("/login.hm")
                .failureUrl("/login.hm?err=1")
                .loginProcessingUrl("/istore_check.hm")
                .and()
                .authenticationProvider(authProvider)
                .logout()
                .and()
                .csrf().disable()
                .addFilterBefore(iStoreFilter, ChannelProcessingFilter.class)
                .addFilterAfter(loginFilter, BasicAuthenticationFilter.class)
                .addFilterAt(logoutFilter, org.springframework.security.web.authentication.logout.LogoutFilter.class)
                .addFilterAt(authenticationProcessingFilter, UsernamePasswordAuthenticationFilter.class)
                .sessionManagement().sessionFixation().migrateSession();
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/services/**")
                .antMatchers(HttpMethod.GET,"/monitor/health")
                .antMatchers(HttpMethod.GET,"/widget/**")
                .antMatchers(HttpMethod.GET,"/login.hm*")
                .antMatchers(HttpMethod.GET,"/istore/login.jsp")
                .antMatchers(HttpMethod.GET,"/istore/logout.jsp")
                .antMatchers(HttpMethod.GET,"/registration.hm*")
                .antMatchers(HttpMethod.GET,"/tnc.hm*")
                .antMatchers(HttpMethod.GET,"/istore/clicktochat/**")
                .antMatchers(HttpMethod.GET,"/logout.hm")
                .antMatchers(HttpMethod.GET,"/istore/theme/**")
                .antMatchers(HttpMethod.GET,"/mstore/theme/**")
                .antMatchers(HttpMethod.GET,"/js/**")
                .antMatchers(HttpMethod.GET,"/breeze/**")
                .antMatchers(HttpMethod.GET,"/resources/**")
                .antMatchers(HttpMethod.GET,"/crossdomain.xml")
    }

    @Override
    @Bean (name ="authenticationManagerBean")
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

P.S.请记住，从3&开始的迁移，请使用基于xml的配置来检查web.xml，因为servlet和过滤器注册是一个重要的部分，如果做得不精确，您会发现自己在其他地方调试，如果正在使用HDIV，请删除它，并并行而不是一起迁移它。