Spring Security:requires-channel ="https"导致重定向循环

Question

我在尝试<security:intercept-url ... requires-channel="https"/>在WAS上正常工作时遇到了问题.应用程序服务器已启用SSL.

当我有这样的配置时: -

<security:http auto-config="true">
    <security:form-login .../>
    <security:logout .../>

    <security:intercept-url pattern="/admin/**" access="ROLE_ADMIN" />
    <security:intercept-url pattern="/**" access="ROLE_ADMIN,ROLE_USER" />
</security:http>

......我可以打两http://server/myapp和https://server/myapp.在这两种情况下,Spring Security都能拦截此URL并向我显示登录页面.

现在,我想要做的是将所有http网址重定向到https网址.所以,我加入requires-channel="https"了<security:intercept-url />

<security:http auto-config="true">
    <security:form-login .../>
    <security:logout .../>

    <security:intercept-url pattern="/admin/**" access="ROLE_ADMIN" requires-channel="https" />
    <security:intercept-url pattern="/**" access="ROLE_ADMIN,ROLE_USER" requires-channel="https" />
</security:http>

...现在,当我尝试击中时http://server/myapp,我看到http://server/myapp/myapp/myapp/myapp/myapp/myapp它进入重定向循环.

所以,我重新定义了端口映射: -

<security:http auto-config="true">
    <security:form-login .../>
    <security:logout .../>

    <security:intercept-url pattern="/admin/**" access="ROLE_ADMIN" requires-channel="https" />
    <security:intercept-url pattern="/**" access="ROLE_ADMIN,ROLE_USER" requires-channel="https" />

    <security:port-mappings>
        <security:port-mapping http="80" https="443"/>
    </security:port-mappings>
</security:http>

...当我尝试点击时http://server/myapp,URL在浏览器栏中没有变化,但我仍然遇到"重定向循环"问题.即使我试图击中https://server/myapp,我仍然会遇到同样的问题.

我已经没有关于如何调试此问题的想法.好像当我添加时requires-channel="https",它在WAS上打破了但它在Jetty上运行得很好.我目前的解决方法是删除requires-channel="https"以便https在WAS上工作,但随后,用户可以使用http访问该站点.

只是为了抛出另一件事,为http添加端口9080和为https添加端口9443并不能解决WAS上的问题.

有任何想法吗？谢谢您的帮助.

Answer 1

我当前的解决方法是删除 require-channel="https" 以便 https 在 WAS 上工作，但随后用户可能会使用 http 访问该站点。

我没有解决该问题的方法，但这里有一个解决此问题的解决方法：

import java.io.IOException;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest; 
import javax.servlet.http.HttpServletResponse; 

import org.springframework.stereotype.Component;     
import org.springframework.web.filter.OncePerRequestFilter; 

@Component
public class UnsecureRequestFilter extends OncePerRequestFilter { 

    @Override 
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) 
                    throws ServletException, IOException { 
        if (!request.isSecure()) {
            response.sendRedirect("https://domain.example.com/");
        } else { 
            filterChain.doFilter(request, response); 
        } 
    }
} 

这是独立于平台的，因此应该与 WAS 以及任何其他容器一起使用。