返回Http状态(例如401)或重定向Spring Security

Question

嗨,我使用此配置Spring Security:

   <http auto-config="true" use-expressions="true">
        <session-management>
            <concurrency-control max-sessions="1" />
        </session-management>

        <form-login login-page="/login" login-processing-url="/resources/j_spring_security_check"  authentication-failure-url="/login?login_error=t"/>
        <logout logout-url="/resources/j_spring_security_logout"/>

        <intercept-url pattern="/resources/**" access="permitAll" />
        <intercept-url pattern="/login" access="permitAll" />

        <intercept-url pattern="/**" access="isAuthenticated()" />
    </http>

如果在我的标题请求中,我需要返回一个Http Error Code类似的内容:否则我想重定向到Login Page.401Content-Typeapplication/json;

但是使用此配置,无论请求内容类型如何,我都会被重定向到具有302响应代码的登录URL .

有没有办法做到这一点？？

编辑: 我想只使用一个servlet来处理html和json所以我试试这个:

@Component
public class CustomEntryPoint extends LoginUrlAuthenticationEntryPoint {

    private final Logger log = LoggerFactory.getLogger(CustomEntryPoint.class);

        public CustomEntryPoint(String loginFormUrl) {
            super(loginFormUrl);
        }

        @Override
        public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException)
                throws IOException, ServletException {

            if(request.getContentType() != null && request.getContentType().equals("application/json")) {
                 response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Access Denied");
            }else {
                super.commence(request, response, authException);
            }

        }
    }

这是我的新安全配置:

<http auto-config="true" use-expressions="true" entry-point-ref="customEntryPoint">
    <session-management>
        <concurrency-control max-sessions="1" />
    </session-management>

    <form-login login-page="/login" login-processing-url="/resources/j_spring_security_check"  authentication-failure-url="/login?login_error=t"/>
    <logout logout-url="/resources/j_spring_security_logout"/>

    <intercept-url pattern="/resources/**" access="permitAll" />
    <intercept-url pattern="/login" access="permitAll" />

    <intercept-url pattern="/**" access="isAuthenticated()" />
</http>

<beans:bean id="customEntryPoint" class="x.x.CustomEntryPoint">
    <beans:constructor-arg value="/login"/>
</beans:bean>

你觉得怎么样？这是一种正确的方法,或者你知道更好的方法吗？

谢谢

Answer 1

我这样解决了:

public class CustomEntryPoint extends LoginUrlAuthenticationEntryPoint {

    private static final String XML_HTTP_REQUEST = "XMLHttpRequest";
    private static final String X_REQUESTED_WITH = "X-Requested-With";

    public CustomEntryPoint(String loginFormUrl) {
        super(loginFormUrl);
    }

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception)
            throws IOException, ServletException {
        if (XML_HTTP_REQUEST.equals(request.getHeader(X_REQUESTED_WITH))) {
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
        } else {
            super.commence(request, response, exception);
        }
    }

}

安全配置是:

<http auto-config="true" use-expressions="true" entry-point-ref="customEntryPoint">
    <session-management>
        <concurrency-control max-sessions="1" />
    </session-management>

    <form-login login-page="/login" login-processing-url="/resources/j_spring_security_check"  authentication-failure-url="/login?login_error=t"/>
    <logout logout-url="/resources/j_spring_security_logout"/>

    <intercept-url pattern="/resources/**" access="permitAll" />
    <intercept-url pattern="/login" access="permitAll" />

    <intercept-url pattern="/**" access="isAuthenticated()" />
</http>

<beans:bean id="customEntryPoint" class="x.x.CustomEntryPoint">
    <beans:constructor-arg value="/login"/>
</beans:bean>