access ="permitAll"和filters ="none"之间的区别？

Question

以下是Spring Security petclinic示例的一部分:

<http use-expressions="true">
    <intercept-url pattern="/" access="permitAll"/>
    <intercept-url pattern="/static/**" filters="none" />
    <intercept-url pattern="/**" access="isAuthenticated()" />
    <form-login />
    <logout />
</http>

access ="permitAll"和filters ="none"之间有什么区别？

网址: http ://static.springsource.org/spring-security/site/petclinic-tutorial.html

Answer 1

不同之处在于filters = "none"禁用指定URL的Spring Security过滤器,而access = "permitAll"在不禁用过滤器的情况下配置授权.

实际上,filters = "none"当它背后的资源需要Spring Security的某些功能时,可能会导致问题.例如,您不能将它用于在提交时执行程序化登录的用户注册页面(用户授权的权限始终为:ROLE_ANONYMOUS？).