Spring Security intercept-url is not matching Wildcard
I try to implement security for my application using spring security.
I intercept page using intercept-url
, for example:
<http auto-config='true'>
<intercept-url pattern="/logList*" access="ROLE_ADMIN" />
<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?error=true" />
<logout />
<remember-me/>
</http>
at the first time i try to access the log for anonymous user using url: localhost/projectname/logList and the page automatically redirect to login page
but when I try access log page using url loca开发者_开发知识库lhost/projectname/logList/
the anonymous user can access the log page
why it can happen when the pattern /logList*
is correct ?
By default, AntPathRequestMatcher is used. If you add another pattern
<intercept-url pattern="/logList/*" access="ROLE_ADMIN" />
then it will work.
Here are tests (Note that with RegexRequestMatcher, same pattern works for both /logList/ and /logList):
@Test
public void antTest1() throws Exception {
AntPathRequestMatcher pathMatcher = new AntPathRequestMatcher("/loglist*");
MockHttpServletRequest mockRequest = new MockHttpServletRequest();
mockRequest.setScheme("http");
mockRequest.setPathInfo("/logList");
Assert.assertThat(pathMatcher.matches(mockRequest), is(true));
}
@Test
public void antTest2() throws Exception {
AntPathRequestMatcher pathMatcher = new AntPathRequestMatcher("/loglist/*");
MockHttpServletRequest mockRequest = new MockHttpServletRequest();
mockRequest.setScheme("http");
mockRequest.setPathInfo("/logList/");
Assert.assertThat(pathMatcher.matches(mockRequest), is(true));
}
@Test
public void regexTest3() throws Exception {
RegexRequestMatcher pathMatcher = new RegexRequestMatcher("/logList.*", "GET");
MockHttpServletRequest mockRequest = new MockHttpServletRequest();
mockRequest.setScheme("http");
mockRequest.setMethod("GET");
mockRequest.setPathInfo("/logList/");
Assert.assertThat(pathMatcher.matches(mockRequest), is(true));
}
@Test
public void regexTest4() throws Exception {
RegexRequestMatcher pathMatcher = new RegexRequestMatcher("/logList.*", "GET");
MockHttpServletRequest mockRequest = new MockHttpServletRequest();
mockRequest.setScheme("http");
mockRequest.setMethod("GET");
mockRequest.setPathInfo("/logList");
Assert.assertThat(pathMatcher.matches(mockRequest), is(true));
}
To use RegexRequestMatcher, add attribute 'request-matcher' to http and set its value to 'regex':
<http auto-config="true" request-matcher="regex">
Does pattern="/logList/**"
make a difference?
精彩评论