Spring security重定向到登录并还原以前输入的表单数据

Question

概述

1. 我用Spring Security保护了Spring Web应用程序
2. 站点上有一个用于输入某些数据的表单，此表单是公共的，但数据将只为经过身份验证的用户处理
3. 如果用户按下submit按钮，但还没有登录，他将被委托到登录页面。如果登录成功，用户将被重定向到数据处理结果可见的站点

null

@Configuration
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private SecurityProperties security;

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {

        auth.inMemoryAuthentication()
            .withUser("admin")
            .password("admin")
            .roles("ADMIN", "USER")
            .and()
            .withUser("user")
            .password("user")
            .roles("USER");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {

            http.authorizeRequests()
                .antMatchers("/", "/inputForm")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .formLogin()
                .loginPage("/login")
                .permitAll()
                .successHandler(new SavedRequestAwareAuthenticationSuccessHandlerCustom())
                .and()
                .csrf()
                .and()
                .logout()
                .logoutUrl("/logout")
                .logoutSuccessUrl("/")
                .invalidateHttpSession(true)
                .and()
                .exceptionHandling()
                .authenticationEntryPoint(new LoginUrlAuthenticationEntryPointCustom("/login"));
    }
}

public class SavedRequestAwareAuthenticationSuccessHandlerCustom extends SavedRequestAwareAuthenticationSuccessHandler {

    @Override
    public void onAuthenticationSuccess(
            HttpServletRequest request,
            HttpServletResponse response,
            Authentication authentication) throws IOException, ServletException {

        String text = (String) request.getSession().getAttribute("text");
        if (text != null) {
            request.getSession().removeAttribute("text");
            setDefaultTargetUrl("/user/dashboard/?text=" + text);
        }

        super.onAuthenticationSuccess(request, response, authentication);
    }
}

public class LoginUrlAuthenticationEntryPointCustom extends LoginUrlAuthenticationEntryPoint {

    public LoginUrlAuthenticationEntryPointCustom(String loginFormUrl) {
        super(loginFormUrl);
    }

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException)
                    throws IOException,
                    ServletException {

        String text = request.getParameter("text");
        request.getSession().setAttribute("text", text);

        super.commence(request, response, authException);
    }
}

更新

我的配置似乎仍然有问题，因为在调试消息中可以看到，请求ist没有被“HttpSessionRequestCache”保存。如果我能做到这一点，我就不必处理自定义实现了。

O.S.S.W.Util.Matcher.andRequestMatcher：试图使用Ant[pattern='/**',GET]O.S.S.W.U.Matcher.AntPathRequestMatcher：请求'post/user/dashboard‘不匹配'GET/**O.S.S.W.Util.Matcher.andRequestMatcher：没有匹配O.S.S.W.Matcher.andRequestMatcher：没有保存为配置的RequestMatcher不匹配

Answer 1

请确保form方法是post
，如下所示

<form th:action="@{/login}" method="post"> 
         <!-- form input -- >
</form>