Spring Security更改请求URI

Question

我将Spring Security集成到一个现有的Spring Boot项目（版本:1.5.3.Release）中。

public HttpServletRequest getCurrentRequest()
{
    final ServletRequestAttributes servletRequestAttributes = 
    (ServletRequestAttributes) 
    RequestContextHolder.currentRequestAttributes();
    return servletRequestAttributes.getRequest();
}

例如：GET请求指向/web-inf/pages/admin/admin_login.jsp:

我的WebSecurityConfig类是：

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter
{
    @Override
    protected void configure(HttpSecurity http) throws Exception
    {
        //jeden Aufruf akzeptieren. Authorisierung und 
    Authentifizierung von Spring Security wird nicht genutzt
    http.authorizeRequests().antMatchers("/").permitAll();
}

    @Override
    public void configure(WebSecurity web) throws Exception
    {
    web.ignoring().antMatchers("/resources/**", "/css/**", "/js/**", 
    "/img/**", "resources/*", "/WEB-INF/**").and().debug(true);
    }
}

相关applicationcontext.xml部分：

<mvc:default-servlet-handler/>
<mvc:annotation-driven/>
<mvc:resources mapping="/resources/**" location="classpath:/WEB-INF/resources/" />

<mvc:interceptors>
    <bean class="org.springframework.web.servlet.i18n.LocaleChangeInterceptor">
        <property name="paramName" value="lang" />
    </bean>
    <bean class="de.abc.xyu.zzz.interceptor.RedirectInterceptor" />
</mvc:interceptors>

<bean id="viewResolver" class="org.springframework.web.servlet.view.InternalResourceViewResolver">
    <property name="viewClass" value="org.springframework.web.servlet.view.JstlView" />
    <property name="prefix" value="/WEB-INF/pages/" />
    <property name="suffix" value=".jsp" />
    <property name="redirectHttp10Compatible" value="false" />
</bean>

安全筛选器链：[WebAsyncManagerIntegrationFilter
SecurityContextPersistenceFilter HeaderWriterFilter CSrffilter
LogoutFilter RequestCacheawareFilter
SecurityContextHolderAwareRequestFilter
AnonymousAuthenticationFilter SessionManagementFilter
ExceptionTranslationFilter FilterSecurityInterceptor]

[http-nio-8081-exec-1]信息Spring Security调试器-

收到GET“/web-inf/pages/admin/admin_login.jsp”的请求：

SecurityContextHolderAwareRequestWrapper[org.springframework.security.web.context.httpsessionSecurityContextRepository$Servlet3SaveTosessionRequestWrapper@2EAC9514]

servletpath：/web-inf/pages/admin/admin_login.jsp pathinfo：null headers：host：localhost：8081连接：keep-alive cache-control：max-age=0用户-代理：mozilla/5.0(x11；Linux x86_64)applewebkit/537.36(KHTML,像Gecko）chrome/62.0.322.94 safari/537.36 upgrade-insecure-requests：1接受：text/html,application/xhtml+xml,application/xml；q=0.9,image/webp,image/apng,/；q=0.8引用：http：//localhost:8081/admin/login接受-编码：gzip,deflate，br接受语言：de-DE,de；q=0.9,en-us；q=0.8,en；q=0.7 cookie:JSessionID=AE07684D485DA698F1AA4DFE056D5B3A；JSESSIONID=0819B947A685FE3362F23E39CE999D3B

安全筛选器链:[]空（由Security='none'绕过）

为什么请求指向/web-inf/pages/login.jsp下的物理路径，而不是它的解析路径？我们如何才能获得“正确”的URI？

Answer 1

最后这对我起作用了：

final ServletRequestAttributes servletRequestAttributes = 
    (ServletRequestAttributes) RequestContextHolder.currentRequestAttributes();

System.out.println("REQUEST URI: " +
     servletRequestAttributes.getRequest()
         .getAttribute("javax.servlet.forward.request_uri"));

这给出了真正的请求URI，而不是它在/WEB-INF/下的“物理路径”。