URL中的Spring Security，尾部斜杠和点 [英] Spring Security, trailing slashes, and dots in URLs

问题描述

我使用Spring Security 3.1.4来保护部署到Tomcat的Spring MVC 3.2.4应用程序。我有以下Spring Security配置：

I use Spring Security 3.1.4 to secure a Spring MVC 3.2.4 application deployed to Tomcat. I have the following Spring Security configuration:

<http auto-config="true" use-expressions="true">
   <http-basic />
   <logout ... />
   <form-login ... />

   <intercept-url pattern="/" access="isAnonymous() or hasRole('ROLE_USER')" />
   <intercept-url pattern="/about" access="isAnonymous() or hasRole('ROLE_USER')" />
   <intercept-url pattern="/login" access="isAnonymous() or hasRole('ROLE_USER')" />
   <intercept-url pattern="/under-construction" access="isAnonymous() or hasRole('ROLE_USER')" />
   <intercept-url pattern="/admin-task*" access="hasRole('ROLE_USER') and hasRole('ROLE_ADMINISTRATOR')" />
   <intercept-url pattern="/resources/**" access="isAnonymous() or hasRole('ROLE_USER')" />
   <intercept-url pattern="/**" access="hasRole('ROLE_USER')" />
</http>

我注意到没有尾部斜杠的网址模式（例如， / about ）不匹配带斜杠的URL（例如， / about / ），反之亦然。换句话说，具有斜杠的URL和没有斜杠的相同URL被Spring Security视为两个不同的URL。可以通过使用两个安全规则来解决该问题：

I noticed that URL patterns without a trailing slash (e.g., /about) do not match URLs with a trailing slash (e.g., /about/) and vice-versa. In other words, a URL with a slash and an identical URL without a slash are treated as two different URLs by Spring Security. The problem could be fixed by using two security rules:

<intercept-url pattern="/about" access="isAnonymous() or hasRole('ROLE_USER')" />
<intercept-url pattern="/about/" access="isAnonymous() or hasRole('ROLE_USER')" />

有更好的解决方案吗？

我知道 path-type =regex允许使用正则表达式定义URL模式，但如果可能的话，我希望避免任何不必要的复杂性。

I know that path-type="regex" allows to define URL patterns with regular expressions, but I would like to avoid any unnecessary complexity if it's possible.

更新

正如Adam Gent所说，还有一个问题涉及带点的网址： Spring MVC将 /about.foo 和 / about 视为相同的URL。但是，Spring Security将它们视为两个不同的URL。因此，可能还需要一个安全规则：

As Adam Gent noted, there is an additional problem that involves URLs with a dot: /about.foo and /about are treated as the same URL by Spring MVC. However, Spring Security treats them as two different URLs. So, one more security rule may be necessary:

<intercept-url pattern="/about.*" .../>

推荐答案

Spring Security 4.1 +

Spring Security现在添加了一个新的匹配器，它知道你的Spring MVC URL匹配配置。这告诉Spring Security根据Spring MVC使用的相同规则匹配路径，从而消除了URL有效但不安全的可能性。

Spring Security 4.1+

Spring Security has now added a new matcher which is aware of your Spring MVC URL matching configuration. This tells Spring Security to match paths based on the same rules that Spring MVC uses, eliminating the possibility of a URL being valid, but unsecured.

首先你需要替换任何与新的MVC匹配器的老匹配器。 Spring Security现在与您同步，但是您已经配置了Spring MVC，因此您可以自由添加或删除任何路径匹配配置。我建议尽可能坚持默认值。

First you need to replace any old matchers with the new MVC matcher. Spring Security is now in sync with however you have configured Spring MVC so you are free to add or remove any path matching configuration. I recommend sticking with the defaults where possible.

如果您使用 antMatchers ，你现在应该使用 mvcMatchers ：

If you were using antMatchers, you now should use mvcMatchers:

protected configure(HttpSecurity http) throws Exception {
  http.authorizeRequests()
        .mvcMatchers("/about").hasRole("USER");
}

XML配置

您需要将 request-matcher 属性添加到 http 标记中：

XML Config

You need to add the attribute request-matcher to your http tag:

<http request-matcher="mvc">
  <intercept-url pattern="/about" access="hasRole('USER')"/>
</http>

完全参考

请注意你也不应该更长的时间用ROLE_作为前缀，因为Spring Security会自动为您执行此操作。

我无法找到一种方法来处理Spring Security中的尾部斜杠和路径后缀。显然，可以编写一个正则表达式来处理这些情况，但这似乎使安全规则过于复杂并容易出错。我希望尽可能自信，我不会意外地暴露资源。

I've not been able to find a way to handle both trailing slash and path suffixes in Spring Security. Obviously it is possible to write a regexp to handle these cases but this seems to make the security rules overly complex and prone to error. I want to be as confident as possible that I'm not exposing resources accidentally.

因此，我的方法是通过将路径匹配器配置为在Spring中禁用此行为严格关于​​尾部斜杠和后缀。

Therefore, my approach is to disable this behaviour in Spring by configuring the path matcher to be strict about both trailing slashes and suffixes.

@Configuration
public class ServletConfig extends WebMvcConfigurerAdapter {
  @Override
  public void configurePathMatch(final PathMatchConfigurer configurer) {
    configurer.setUseSuffixPatternMatch(false);
    configurer.setUseTrailingSlashMatch(false);
  }
}

XML配置

XML Config

<mvc:annotation-driven>
  <mvc:path-matching suffix-pattern="false" trailing-slash="false" />
</mvc:annotation-driven>

这篇关于URL中的Spring Security，尾部斜杠和点的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！