Spring boot Security总是重定向到home.jsp

Question

目前，我正在使用Spring Boot 1.4.0版本进行开发，使用Spring security进行身份验证。要求是当用户第一次登录时，需要重定向到密码重置页面，否则应该重定向到主页。应用程序总是重定向home.jsp，而与成功处理程序中配置的url无关。

WebSecurityConfiguration

          html" target="_blank">http.authorizeRequests()
         .antMatchers("/resources/**","/rest/**","/log*")
         .permitAll()
         .antMatchers("/admin**").hasAuthority("admin") 
         .anyRequest()
         .authenticated()
         .and()
         .formLogin()
         .loginPage("/login")
         .successHandler(authHandler)
         .failureHandler(authFailureHandler)
         .usernameParameter("username").passwordParameter("password")
         .permitAll()
         .and()
         .logout()
         .invalidateHttpSession(true)
         .logoutSuccessUrl("/login?logout")
         .permitAll()
         .and()
         .csrf().disable(); 

公共类AuthSuccessShandler扩展了SimpleUrlAuthenticationSuccessShandler{

private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();
@Override
protected void handle(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException {
    HttpSession session = request.getSession(false);
    String isFirstTimePwd = String.valueOf(session.getAttribute("IsFirstTimeLogIn"));
    if (isFirstTimePwd.equalsIgnoreCase("true"))
    {
        redirectStrategy.sendRedirect(request,response,"/firstTime");
    }
    else
    {
        redirectStrategy.sendRedirect(request, response, "/home");
    }
}

}

@RequestMapping(value = "/firstTime", method = RequestMethod.GET)
public String displayFirstTimeLoginPage(HttpServletRequest request,HttpServletResponse response) {
    return "firstTime";
}

@RequestMapping(value = "/home", method = RequestMethod.GET)
public ModelAndView homePage(HttpServletRequest request,HttpServletResponse response) {
    HttpSession  session = request.getSession();
    User user =(User)  session.getAttribute("User");
    return new ModelAndView("home", "loggedInUser", user);
}

此外，我还尝试通过重写onAuthenticationsuccess（）来实现AuthenticationSuccessShandler，但仍然重定向home.jsp而不是密码重置页面。

Answer 1

你最好去主页测试一下这是不是第一次

@RequestMapping(value = "/home", method = RequestMethod.GET)
    public ModelAndView homePage(HttpServletRequest request,HttpServletResponse response) {

    if (isFirstTimePwd.equalsIgnoreCase("true"))
        {
            redirectStrategy.sendRedirect(request,response,"/firstTime");
        }

        HttpSession  session = request.getSession();
        User user =(User)  session.getAttribute("User");
        return new ModelAndView("home", "loggedInUser", user);
    }

编辑1：

@RequestMapping(value = "/home", method = RequestMethod.GET)
        public ModelAndView homePage(HttpServletRequest request,HttpServletResponse response) {

         HttpSession  session = request.getSession();
            User user =(User)  session.getAttribute("User");
        if (isFirstTimePwd.equalsIgnoreCase("true"))
            {
                 return new ModelAndView("firstTime", "loggedInUser", user);
            }

            return new ModelAndView("home", "loggedInUser", user);
        }