向SpringSecurity命名空间FilterChain添加多个筛选器

Question

<http pattern="/javax.faces.resource/**" security="none"/>
<http pattern="/resources/**" security="none"/> 
<http pattern="/session_list.jsp" security="none"/>
<http pattern="/security/cas_logout.jsf" security="none"/>
<http pattern="/user/account_signup.jsf" security="none"/>
<http pattern="/user/company_user_association.jsf" security="none"/>
<http pattern="/user/account_signup_review.jsf" security="none"/>                       

<http auto-config="true" use-expressions="true" entry-point-ref="casEntryPoint" access-decision-manager-ref="accessDecisionManager">            
    <intercept-url pattern="/**" access="hasRole('ROLE_USER')"/>
    <logout logout-success-url="/security/cas_logout.jsf" invalidate-session="true"/>
    <custom-filter position="CAS_FILTER" ref="casFilter"/>
    <custom-filter ref="requestSingleLogoutFilter" before="LOGOUT_FILTER"/>
    <custom-filter ref="singleLogoutFilter" before="CAS_FILTER"/>       
</http>

     <beans:bean id="portalSessionFilter" class="org.x.web.security.PortalSessionInterceptor"/>     
     <beans:bean id="requestUrlStackFilter" class="org.x.web.security.RequestUrlStackFilter"/>

<custom-filter ref="portalSessionFilter" before="LAST"/>

我尝试创建另一个FilterChainProxy bean，在其链列表中包含上述两个过滤器，并将该bean作为自定义过滤器添加到之前的名称空间配置中，过滤器似乎可以工作，但我的JSF导航中断了，特别是在commandLink中（我认为使用此FilterChainProxy时AJAX调用失败）

有没有人可以就如何将这两个过滤器和可能的其他过滤器添加到Spring Security过滤器链提出任何想法？

Answer 1

我找到了解决问题的办法。我通过实现自己的过滤器链而不是使用spring security filter chain代理链接我的过滤器来解决它。FilterChainProxy的问题是它在过滤器链的末尾使用了reset方法，如果您将它注入到主Spring Security过滤器链代理之间，这将导致问题。

自定义筛选器链只是处理所需的筛选器，并将控制权交还给主spring security FilterChainProxy。以下是配置在更改后的处理方式

<http auto-config="false" use-expressions="true" entry-point-ref="casEntryPoint" access-decision-manager-ref="accessDecisionManager">           
    <intercept-url pattern="/**" access="hasRole('ROLE_USER')"/>
    <logout logout-success-url="/security/cas_logout.jsf" invalidate-session="true"/>
    <custom-filter position="CAS_FILTER" ref="casFilter"/>
    <custom-filter ref="requestSingleLogoutFilter" before="LOGOUT_FILTER"/>
    <custom-filter ref="singleLogoutFilter" before="CAS_FILTER"/>
    <custom-filter ref="customFilterChain" before="LAST"/>
</http>

<beans:bean id="customFilterChain" class="org.x.web.security.CustomFilterChain">
<beans:constructor-arg>
    <beans:list>
        <filter-chain pattern="/javax.faces.resource/**" filters="none"/>
        <filter-chain pattern="/resources/**" filters="none"/>
        <filter-chain pattern="/**" filters="portalSessionFilter,requestUrlStackFilter"/>
    </beans:list>
</beans:constructor-arg>