Question

使用Spring security 3.2，我试图拦截URL如下：

<security:http  use-expressions="true"  path-type="regex" >

    <security:intercept-url pattern="/jsp/Error_403.jsp" access="hasAnyRole('ROLE_VISITOR','ROLE_ADMIN','ROLE_BRONZE_SUB','ROLE_BRONZE_TEST','ROLE_SILVER_SUB','ROLE_SILVER_TEST','ROLE_GOLD_SUB','ROLE_GOLD_TEST')" />
    <security:intercept-url pattern="/jsp/LoggedOut.jsp" access="hasAnyRole('ROLE_VISITOR','ROLE_ADMIN','ROLE_BRONZE_SUB','ROLE_BRONZE_TEST','ROLE_SILVER_SUB','ROLE_SILVER_TEST','ROLE_GOLD_SUB','ROLE_GOLD_TEST')" />
    <security:intercept-url pattern="/jsp/home/header.html" access="hasAnyRole('ROLE_VISITOR','ROLE_ADMIN','ROLE_BRONZE_SUB','ROLE_BRONZE_TEST','ROLE_SILVER_SUB','ROLE_SILVER_TEST','ROLE_GOLD_SUB','ROLE_GOLD_TEST')"/>
    <security:intercept-url pattern="/unjust?action=statistics" access="hasAnyRole('ROLE_ADMIN','ROLE_GOLD_SUB','ROLE_GOLD_TEST')" />
    <security:intercept-url pattern="/unjust?action=browse" access="hasAnyRole('ROLE_ADMIN')" />
    <security:intercept-url pattern="/unjust?action=search" access="hasAnyRole('ROLE_ADMIN','ROLE_BRONZE_SUB','ROLE_BRONZE_TEST','ROLE_SILVER_SUB','ROLE_SILVER_TEST','ROLE_GOLD_SUB','ROLE_GOLD_TEST')" />
    <security:intercept-url pattern="/unjust?action=home" access="hasAnyRole('ROLE_ADMIN','ROLE_BRONZE_SUB','ROLE_BRONZE_TEST','ROLE_SILVER_SUB','ROLE_SILVER_TEST','ROLE_GOLD_SUB','ROLE_GOLD_TEST')" />
            <security:intercept-url pattern="/unjust" access="hasAnyRole('ROLE_VISITOR','ROLE_ADMIN','ROLE_BRONZE_SUB','ROLE_BRONZE_TEST','ROLE_SILVER_SUB','ROLE_SILVER_TEST','ROLE_GOLD_SUB','ROLE_GOLD_TEST')"/>


    <security:intercept-url pattern="/**" access="denyAll" />
    <access-denied-handler error-page="/jsp/Error_403.jsp"/>

    <security:logout  />
    <security:openid-login login-page="/openidlogin.jsp"
        user-service-ref="registeringUserService" authentication-failure-url="/openidlogin.jsp?login_error=true">
        <attribute-exchange identifier-match="https://www.google.com/.*">
            <openid-attribute name="email"
                type="http://axschema.org/contact/email" required="true" count="1" />
            <openid-attribute name="firstname"
                type="http://axschema.org/namePerson/first" required="true" />
            <openid-attribute name="lastname"
                type="http://axschema.org/namePerson/last" required="true" />
        </attribute-exchange>

        <attribute-exchange identifier-match=".*myopenid.com.*">
            <openid-attribute name="email"
                type="http://schema.openid.net/contact/email" required="true" />
            <openid-attribute name="fullname"
                type="http://schema.openid.net/namePerson" required="true" />
        </attribute-exchange>
    </security:openid-login>
    <remember-me token-repository-ref="tokenRepo" />
</security:http>

当我尝试执行例如浏览操作时，我无法进行身份验证，日志显示：

12889 [http-bio-8080-exec-14] DEBUG org.springframework.security.web.FilterChainProxy  - /unjust?action=statistics at position 11 of 11 in additional filter chain; firing Filter: 'FilterSecurityInterceptor'
12889 [http-bio-8080-exec-14] DEBUG org.springframework.security.web.util.RegexRequestMatcher  - Checking match of request : '/unjust?action=statistics'; against '/jsp/Error_403.jsp'
12889 [http-bio-8080-exec-14] DEBUG org.springframework.security.web.util.RegexRequestMatcher  - Checking match of request : '/unjust?action=statistics'; against '/jsp/LoggedOut.jsp'
12889 [http-bio-8080-exec-14] DEBUG org.springframework.security.web.util.RegexRequestMatcher  - Checking match of request : '/unjust?action=statistics'; against '/jsp/home/header.html'
12889 [http-bio-8080-exec-14] DEBUG org.springframework.security.web.util.RegexRequestMatcher  - Checking match of request : '/unjust?action=statistics'; against '/unjust?action=statistics'
12889 [http-bio-8080-exec-14] DEBUG org.springframework.security.web.util.RegexRequestMatcher  - Checking match of request : '/unjust?action=statistics'; against '/unjust?action=browse'
12889 [http-bio-8080-exec-14] DEBUG org.springframework.security.web.util.RegexRequestMatcher  - Checking match of request : '/unjust?action=statistics'; against '/unjust?action=search$'
12890 [http-bio-8080-exec-14] DEBUG org.springframework.security.web.util.RegexRequestMatcher  - Checking match of request : '/unjust?action=statistics'; against '/unjust?action=home'
12890 [http-bio-8080-exec-14] DEBUG org.springframework.security.web.util.RegexRequestMatcher  - Checking match of request : '/unjust?action=statistics'; against '/unjust'
12890 [http-bio-8080-exec-14] DEBUG    org.springframework.security.web.access.intercept.FilterSecurityInterceptor  - Secure object: FilterInvocation: URL: /unjust?action=statistics; Attributes: [denyAll]
12890 [http-bio-8080-exec-14] DEBUG   org.springframework.security.web.access.intercept.FilterSecurityInterceptor  - Previously  Authenticated: [org.springframework.security.openid.OpenIDAuthenticationToken@c8f995e9: Principal: unjust.beans.CustomUserDetails@d66c4fbd: Username: https://www.google.com/accounts/o8/id?xxxxx; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_BRONZE_SUB; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@380f4: RemoteIpAddress: 127.0.0.1; SessionId: 6F57A4A404D2BC3CD82391F6973FA715; Granted Authorities: ROLE_BRONZE_SUB, attributes : xxxxxx
12890 [http-bio-8080-exec-14] DEBUG org.springframework.security.access.vote.AffirmativeBased  - Voter: org.springframework.security.web.access.expression.WebExpressionVoter@b041b0, returned: -1
12890 [http-bio-8080-exec-14] DEBUG org.springframework.security.web.access.ExceptionTranslationFilter  - Access is denied (user is not anonymous); delegating to AccessDeniedHandler
org.springframework.security.access.AccessDeniedException: Access is denied

我在StackOverflow上看过很多关于正则表达式有多种不同格式的帖子，从上面的内容到

<security:intercept-url pattern="\A^/unjust?action=search.$\Z"

我已经能够使用ant路径匹配器生成匹配，但是当我收到这样的请求时，事情会失败：

/unjust?action=browseUNDT&sEcho=1&iColumns=7&sColumns=&iDisplayStart=0&iDisplayLength=10&mDataProp_0=caseName&mDataProp_1=caseId&mDataProp_2=judgmentDate&mDataProp_3=judgmentType&mDataProp_4=judgmentNo&mDataProp_5=docId&mDataProp_6=displayCase&sSearch=&bRegex=false&sSearch_0=&bRegex_0=false&bSearchable_0=true&sSearch_1=&bRegex_1=false&bSearchable_1=true&sSearch_2=&bRegex_2=false&bSearchable_2=true&sSearch_3=&bRegex_3=false&bSearchable_3=true&sSearch_4=&bRegex_4=false&bSearchable_4=true&sSearch_5=&bRegex_5=false&bSearchable_5=true&sSearch_6=&bRegex_6=false&bSearchable_6=true&iSortCol_0=0&sSortDir_0=asc&iSortingCols=1&bSortable_0=true&bSortable_1=true&bSortable_2=true&bSortable_3=true&bSortable_4=true&bSortable_5=true&bSortable_6=true&_=1379771161138

介于两者之间。

有人可以引导我进行此模式匹配的正确设置和语法吗？

Answer 1

默认情况下，Spring不支持url中的参数匹配。使用regex matcher使用request-matcher =“regex”或path-type =“regex”，你可以使用正则表达式来匹配网址。现在你提供的模式= /unjust?action=browse“？”表示正则表达式中出现的特殊符号。你应该逃脱？在您的模式中使用"\\?"

Spring Security url-intercept与正则表达式匹配失败

1 个答案: