Spring Security-expiredUrl不起作用
问题内容:
我需要expired-url
在Spring MVC应用程序中进行配置。这是我的努力,但没有效果:
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.addFilterBefore(adminAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
.addFilterBefore(customerAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class)
.csrf()
.disable()
.authorizeRequests()
.antMatchers("...", "...", "...").permitAll()
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/admin/login")
.and()
.logout()
.addLogoutHandler(customLogoutHandler())
.logoutSuccessHandler(customLogoutSuccessHandler())
.logoutUrl("/logout")
.deleteCookies("remove")
.invalidateHttpSession(true)
.permitAll()
.and()
.sessionManagement()
.maximumSessions(1)
.expiredUrl("/expired");
}
这没有任何效果,并且当用户的会话超时时,spring不会将其重定向到/expired
url,而只是将其重定向到/admin/login
url。
更新:
我在评论和答案中尝试了建议的解决方案,但没有看到任何效果。此外,我除去addLogoutHandler()
,logoutSuccessHandler()
以及两个addFilterBefore()
在开始的方法,而不是工作。
我也以这种方式尝试了另一种解决方案:
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.addFilterBefore(sessionManagementFilter(), SessionManagementFilter.class)
.csrf()
.disable()
.authorizeRequests()
.antMatchers("...", "...", "...").permitAll()
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/admin/login")
.and()
.logout()
.logoutUrl("/logout")
.deleteCookies("remove")
.invalidateHttpSession(true)
.permitAll();
}
@Bean
public SessionManagementFilter sessionManagementFilter() {
SessionManagementFilter sessionManagementFilter = new SessionManagementFilter(httpSessionSecurityContextRepository());
sessionManagementFilter.setInvalidSessionStrategy(simpleRedirectInvalidSessionStrategy());
return sessionManagementFilter;
}
@Bean
public SimpleRedirectInvalidSessionStrategy simpleRedirectInvalidSessionStrategy() {
SimpleRedirectInvalidSessionStrategy simpleRedirectInvalidSessionStrategy = new SimpleRedirectInvalidSessionStrategy("/expired");
return simpleRedirectInvalidSessionStrategy;
}
@Bean
public HttpSessionSecurityContextRepository httpSessionSecurityContextRepository(){
HttpSessionSecurityContextRepository httpSessionSecurityContextRepository = new HttpSessionSecurityContextRepository();
return httpSessionSecurityContextRepository;
}
谁能帮我解决这个问题?
问题答案:
我以这种方式尝试了 Ali Dehghani 的解决方案(在评论中):
.sessionManagement().maximumSessions(1).and().invalidSessionUrl("/expired");
就像 编码员 所说的那样,添加"/expired"
允许的网址,问题就解决了。感谢所有关注我的问题的人,特别是 Ali Dehghani
和 The Coder 的有用评论。