spring spring 3中无法允许静态资源 [英] unable to allow static resources in spring security 3

问题描述

我无法在spring security 3.允许静态资源（如js，css，images）3.Below是我的配置文件。

I am unable to allow static resources(like js,css,images) in spring security 3.Below is my config file.

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:security="http://www.springframework.org/schema/security"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
              http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
              http://www.springframework.org/schema/security 
              http://www.springframework.org/schema/security/spring-security-3.1.xsd">



    <bean id="authenticationEntryPoint"
        class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
        <property name="loginFormUrl" value="/login.htm" />
    </bean>

    <security:http security="none" pattern="/js/ajaxScript.js"/>   
    <security:http security="none" pattern="/js/commonScript.js"/>  

    <bean class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler" />

    <security:http auto-config="false" entry-point-ref="authenticationEntryPoint" disable-url-rewriting="true" use-expressions="true">

        <security:custom-filter position="FORM_LOGIN_FILTER"
            ref="customAuthenticationProcessingFilter" />

<!--        <security:intercept-url pattern="/js/jquery.min.js" access="isAuthenticated()" /> -->
<!--        <security:intercept-url pattern="/js/**/**" access="permitAll" />  -->
        <security:intercept-url pattern="/displayAdminPage.htm" access="hasRole('ROLE_ADMIN')" />
        <security:access-denied-handler ref="accessDeniedHandler" />

    </security:http>

    <security:authentication-manager alias="authenticationManager">
       <security:authentication-provider user-service-ref="customUserDetailService">
       </security:authentication-provider>
    </security:authentication-manager> 

    <bean id="customUserDetailService" class="com.qait.cdl.services.impl.UserSecurityServiceImpl">
        <property name="userDao" ref="userDao"/>
       </bean>

    <bean id="customAuthenticationProcessingFilter"
        class="com.qait.cdl.services.impl.CustomAuthenticationProcessingFilter">
        <property name="authenticationManager" ref="authenticationManager" />
    </bean>

    <bean id="accessDeniedHandler"
        class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
        <property name="errorPage" value="/WEB-INF/jsp/customLoginForm/denied.jsp" />
    </bean>
</beans> 

我不知道我错在哪里？我想要所有js，图片，css必须绕行通过spring security.JS文件存在于webapp / js和webapp / js / commonScript文件夹中。图像存在于webapp / images文件夹中。

I don't know where I am wrong?I want all js,images,css must be bypass by spring security.JS files are present in webapp/js and webapp/js/commonScript folder.Images are present in webapp/images folder.

下面是我的web.xml

Below is my web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    id="WebApp_ID" version="2.5">
    <display-name>cdl</display-name>
    <servlet>
        <servlet-name>dispatcher</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>dispatcher</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

    <servlet>
        <servlet-name>startUpServlet</servlet-name>
        <servlet-class>com.qait.cdl.commons.startup.StartUpServlet</servlet-class>
        <load-on-startup>2</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>startUpServlet</servlet-name>
        <url-pattern>/startUpServlet.htm</url-pattern>
    </servlet-mapping>

    <welcome-file-list>
        <welcome-file>redirect.jsp</welcome-file>
    </welcome-file-list>

    <context-param>
        <param-name>CDL_ENV</param-name>
        <param-value>staging</param-value>
    </context-param>

    <listener>
        <listener-class>com.qait.cdl.commons.startup.CdlContextListner</listener-class>
    </listener>

    <!-- Session timeout -->
    <session-config>
        <session-timeout>600</session-timeout>
    </session-config>

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <context-param>
     <param-name>contextConfigLocation</param-name>
     <param-value>
     WEB-INF/applicationContext.xml
<!--      WEB-INF/SpringSecurityConfig.xml -->
     WEB-INF/dispatcher-servlet.xml
     </param-value>
    </context-param>

</web-app>

推荐答案

更新：

从更新的问题来看，静态资源映射存在问题。我们需要在spring配置中添加静态资源映射，因为所有请求都被传递给调度程序servlet。

From the updated question it is problem with static resource mapping. We need to add a static resource mapping in the spring configuration since all requests are passed to the dispatcher servlet.

需要将以下内容添加到dispatcher-servelt.xml

Need to add the following to dispatcher-servelt.xml

<mvc:resources mapping="/js/**" location="/js/" />

这篇关于spring spring 3中无法允许静态资源的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！