Question

我有与此相同的问题，但答案对我来说没有意义。

Spring Security Access Denied Handler - how do you determine what the URL was that the user tried to access?

我试图通过创建它来遵循他们在答案中所说的内容：

@RequestMapping("/invalidPermission")
public void invalidPermission(HttpServletRequest request) {
  System.out.println(request.getServletPath());
}

但是，request.getServletPath（）显然会打印出/ invalidPermission而不是他们试图访问的原始URL。

有什么想法吗？

谢谢！

更新：这是工作代码

<access-denied-handler ref="FooAccessDeniedHandler" />
<bean id="FooAccessDeniedHandler"
     class="my.pkg.AccessDeniedExceptionHandler">
  <property name="errorPage" value="/path-to/custom403.jsp" />
</bean>

package my.pkg.AccessDeniedExceptionHandler;

import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.access.AccessDeniedHandler;

public final class AccessDeniedExceptionHandler implements AccessDeniedHandler {

    private String errorPage;

    @Override
    public void handle(final HttpServletRequest request, final HttpServletResponse response, final AccessDeniedException arg2) throws IOException, ServletException {
        System.out.println(String.format("URL [%s] ", request.getServletPath()));
        response.sendRedirect(getErrorPage());
    }

    public String getErrorPage() {
        return errorPage;
    }

    public void setErrorPage(String errorPage) {
        this.errorPage = errorPage;
    }

}

Answer 1

在那个答案中，他们使用的是自定义AccessDeniedHandler的handle（）方法，而不是控制器操作。

Spring Security访问被拒绝处理程序

1 个答案: