为什么我的自定义登录页面在 Spring Security 4 中不显示? [英] Why doesn't my custom login page show with Spring Security 4?

问题描述

我可以在 Spring Security 3.2.4 中使用自定义登录页面，但是在使用 4.0.0 迁移下面的代码后，我看到一个通用登录表单而不是我的自定义登录表单:

I am able to use a custom login page with Spring Security 3.2.4, but after migrating with the code below using 4.0.0, I see a generic login form instead of my custom one:

  <beans:bean id="authSuccessHandler" class="com.company.web.RoleBasedAuthenticationSuccessHandler" />

  <http disable-url-rewriting="false" use-expressions="true">
    <form-login login-page="/login"
        username-parameter="j_username"
        password-parameter="j_password"
        login-processing-url="/j_spring_security_check"
        authentication-failure-url="/login?login_error=true"
        authentication-success-handler-ref="authSuccessHandler"/>
    <!-- SOME INTERCEPT-URLs (redacted) -->
    <intercept-url pattern="/login" access="permitAll"/>
    <remember-me 
         remember-me-parameter="_spring_security_remember_me"
         remember-me-cookie="SPRING_SECURITY_REMEMBER_ME_COOKIE"/>
    <logout 
         logout-url="/j_spring_security_logout" 
         logout-success-url="/index" />
  </http>

我还尝试在各种 Spring 类上启用调试日志记录.我将它设置在我的自定义 authSuccessHandler 上，但我没有看到它的任何输出.在 SO 或 Google 上搜索也不走运.

I also tried enabling debug logging on the various Spring classes. I set it on my custom authSuccessHandler, but I don't see any output from it. No luck with searching on SO or Google either.

这个配置有什么不兼容的地方吗?

Is there anything incompatible about this configuration?

更新:

我也在使用 Apache Tiles:

I'm also using Apache Tiles as so:

  <definition name="login" extends="scrollableLayout">
    <put-attribute name="header" value="/WEB-INF/jsp/heading_blue.jsp"/>
    <put-attribute name="body" value="/WEB-INF/jsp/login.jsp"/>
  </definition>

并使用以下内容:

  <mvc:view-controller path="/login" />  

推荐答案

Spring Security 3.x 使用 spring_security_login 作为默认登录 URL (source: 官方文档).这可以设置为自定义值，如 并映射到控制器以呈现自定义页面.

Spring Security 3.x used spring_security_login as the default login URL (source: official documentation). This could be set to a custom value as <security:form-login login-page="/login"> and mapped to a controller to render a custom page.

Spring Security 4.x 已经放弃了 spring_security_login 并改用 login 作为默认登录 URL(source:官方Spring安全 4.x 迁移指南).因此，URL login 现在转到默认的 Spring Security 基础设施，显示默认的、自动生成的登录页面.

Spring Security 4.x has abandoned spring_security_login and switched to login as the default login URL (source: official Spring Security 4.x migration guide). Therefore, the URL login now goes to the default Spring Security infrastructure, that displays the default, auto-generated login page.

如果您使用 JSP 作为视图渲染技术，补救方法很简单.只需将您的登录页面重命名为 login.jsp，将其放入页面层次结构的根文件夹中，Spring Security 将自动选取它.如果您不使用 JSP，则必须使用不同的 login-page 值(可能是 signin 而不是 login，然后更改您的控制器映射也是如此.

The remedy is simple if you are using JSP as the view rendering technology. Simply rename your login page to login.jsp, drop it in the root folder of the page hierarchy and Spring Security will pick it up automatically. If you are not using JSP, you will have to use a different login-page value (perhaps signin instead of login and then change your controller mapping as well.

请注意，4.x 中的默认注销 URL 也发生了变化.如果您为注销 URL 编写了任何自定义逻辑，请务必一并查看.

Note that the default logout URL has also changed in 4.x. If you have any custom logic written for the logout URL, do make sure to review that as well.

请查看官方迁移指南，因为 4.x 中发生了很多变化.

Do review the official migration guide as a lot of things have changed in 4.x.

这篇关于为什么我的自定义登录页面在 Spring Security 4 中不显示?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！