SpringSecurity-成功登錄后重定向到輸入的url

我一直致力于 Spring Security，我使用基于角色的身份驗證。如果用戶是管理員，他將被定向到 admindashboard，用戶將被重定向到他各自的儀表板，在那里他們共享一個公共登錄門戶。

如果一個人在登錄前輸入管理員/用戶儀表板的 url，它會要求該人登錄但不會重定向到輸入的 url。而是拋出錯誤“無法呼叫 sendRedirect”。

我的安全組態檔代碼

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.authentication.logout.LogoutSuccessHandler;
import org.springframework.web.util.UrlPathHelper;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private UserDetailsService userDetailsService;
    @Autowired private LoginSuccessHandler loginSuccessHandler;
    @Bean
    AuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider provider=new DaoAuthenticationProvider();
        provider.setUserDetailsService(userDetailsService);
        provider.setPasswordEncoder(new BCryptPasswordEncoder());
        return provider;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/").permitAll()
        .antMatchers("/userhome").hasAuthority("USER").
        antMatchers("/adminhome").hasAuthority("ADMIN")
        .antMatchers("/register").permitAll()
        .and().formLogin().loginPage("/login")
        .successHandler(loginSuccessHandler)
        .permitAll().and().logout().logoutSuccessHandler(new LogoutSuccessHandler() {
            @Override
            public void onLogoutSuccess(HttpServletRequest request,HttpServletResponse response,Authentication authentication) throws   IOException,ServletException{
                System.out.println("The User " authentication.getName()   " has logged out");
                UrlPathHelper helper=new UrlPathHelper();
                String context=helper.getContextPath(request);
                response.sendRedirect(context "/home");
            }
        }).permitAll();
        http.csrf().disable();
        
    }
    
    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    
}

我的登錄成功處理程式

package strictly.cinema.config;

import java.io.IOException;
import java.util.Collection;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler;
import org.springframework.stereotype.Component;

import strictly.cinema.service.CustomUserDetails;

@Component
public class LoginSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler{
    @Override
     public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
                Authentication authentication) throws ServletException, IOException {
     
            CustomUserDetails userDetails = (CustomUserDetails) authentication.getPrincipal();
            Collection<? extends GrantedAuthority> authorities =userDetails.getAuthorities();
            authorities.forEach(auth->System.out.println(auth.getAuthority()));
            String redirectURL=request.getContextPath();
            if(userDetails.hasRole("USER"))
                redirectURL ="/userhome";
            else if(userDetails.hasRole("ADMIN"))
                redirectURL ="/adminhome";
            
            response.sendRedirect(redirectURL);
            super.onAuthenticationSuccess(request, response, authentication); 
        }
}

覆寫安全處理程式本身中的注銷處理程式。需要幫助來存盤輸入的 URL 一旦用戶通過身份驗證并有資格訪問 URL 他應該在登錄后被重定向到 URL

uj5u.com熱心網友回復：

您可以將他重定向到成功端點，而不是使用 successHandler，如下所示：

.defaultSuccessUrl("/loginSuccess")

新端點將根據他的角色將他重定向到“/userhome”或“/adminhome”。（以下未測驗）

成功終點：

@GetMapping("/loginSuccess")
public void getLoginInfo(
        @AuthenticationPrincipal UserDetails authentication,
        HttpServletResponse response) throws IOException {
    if (authentication.getAuthorities()
            .contains(new SimpleGrantedAuthority("ADMIN"))) {
        response.sendRedirect("/adminhome");
    } else {
        response.sendRedirect("/userhome");
    }
}

標籤：弹簧靴验证弹簧MVC网址弹簧安全

上一篇：僅保留href和src的子目錄（ROOThtml鏈接）

下一篇：使用nebular選單欄項的“url”屬性時如何避免頁面重新加載