错误“err_invalid_redirect”到表单登录

Question

为什么在给用户授权的时候会出这个错误。一切都是按照指示做的。

@Autowired private UserDetailsService userDetailsService;

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        //auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
        auth.userDetailsService(userDetailsService).passwordEncoder(NoOpPasswordEncoder.getInstance());
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
    .authorizeRequests()
        .antMatchers("/accaunt/company/**").hasRole("COMPANY")
        .antMatchers("/accaunt/resume/**").hasRole("WORKER")
        .antMatchers("/accaunt/**").authenticated()
        .anyRequest().permitAll()
    .and()
        /*
         *  установка второго параметра (alwaysUse) в false 
         *  говорит Spring Security что в случае успешной 
         *  авторизации можно перенаправить пользователя на 
         *  ту страничку, с которой он пришел на страницу аутентификации. 
         */
        .formLogin()
        .defaultSuccessUrl("/accaunt/main", true)
        .loginPage("/login")
        .permitAll()
    .and()
        .logout()
        .logoutSuccessUrl("/login")
        .permitAll()
    .and()
        .csrf().disable()
            .requiresChannel() //config request to use the mapping to a required channel
                .anyRequest().requiresSecure();

    //maps the port 8080(http) to 8443(https)
    http.portMapper().http(8080).mapsTo(8181); 

}

Answer 1

在我头顶上,

1. servlet容器未将请求标记为安全，并将HttpServletRequest.GetScheme设置为返回正确的值
2. 另一个筛选器正在捕获请求
3。

您可以在筛选器链的早期插入一个筛选器，以便在请求进入时特别查看HttpServletRequest.getScheme值。这是Spring Security用于进行评估的方法。

git clone https://github.com/fhanik/spring-security-community.git
cd spring-security-community
./gradlew :spring-security-community-samples-requires-secure-with-redirect:bootRun

工作配置可能如下所示：

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // @formatter:off
    http
        //application security
        .authorizeRequests()
            .mvcMatchers("/non-secure/**").permitAll()
            .anyRequest().hasRole("USER")
            .and()
        .formLogin()
            .and()
        .requiresChannel().anyRequest().requiresSecure()
            .and()
        .portMapper().http(8080).mapsTo(8081)
    ;
    // @formatter:on
    }

}

我还创建了验证此配置的集成测试。