Spring Boot-Spring Security Filters的双重初始化[副本]

Question

我正在将一个Spring3 webapp迁移到一个Spring4 Spring Boot webapp。

<sec:http pattern="/**/*.css" security="none" />
<sec:http pattern="/**/*.js" security="none" />

<sec:http pattern="^.*\?basic-auth=on$" request-matcher="regex" create-session="never">
    <sec:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" />
    <sec:http-basic />
</sec:http>

<sec:http name="formAuth" pattern="^(.*(\?|&amp;)form-auth=on)|/servlet/login\.html|/servlet/!login\.html$" request-matcher="regex"
    entry-point-ref="security.formLogin.entryPoint">

    <sec:intercept-url pattern="/servlet/login.html" access="IS_AUTHENTICATED_ANONYMOUSLY"  />
    <sec:intercept-url pattern="/servlet/!login.html" access="IS_AUTHENTICATED_ANONYMOUSLY" />
    <sec:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" />

    <sec:form-login login-page="/servlet/login.html"
        login-processing-url="/servlet/!login.html"
                    default-target-url="/" authentication-failure-handler-ref="accessDeniedHandler"></sec:form-login>
</sec:http>

    org.springframework.security.authentication.AuthenticationCredentialsNotFoundException: An Authentication object was not found in the SecurityContext
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.credentialsNotFound(AbstractSecurityInterceptor.java:379)
at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:223)
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:124)
at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:208)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.springframework.boot.web.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:115)

Answer 1

如果您试图添加不需要通过身份验证机制保护的静态资源，则应该使用Spring-Boot的“静态内容”特性。

短版本是将静态资源添加到其中一个文件夹中，它将映射到“/**”：

├───src
│   ├───main
│   │     └───resources
│   │            ├───public
│   │            ├───resources
│   │            ├───static