开发者

Spring Security intercept-url is not matching Wildcard

I try to implement security for my application using spring security. I intercept page using intercept-url, for example:

<http auto-config='true'>
    <intercept-url pattern="/logList*" access="ROLE_ADMIN" />
    <form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?error=true" />
    <logout />
    <remember-me/>
</http> 

at the first time i try to access the log for anonymous user using url: localhost/projectname/logList and the page automatically redirect to login page

but when I try access log page using url loca开发者_开发知识库lhost/projectname/logList/ the anonymous user can access the log page

why it can happen when the pattern /logList* is correct ?


By default, AntPathRequestMatcher is used. If you add another pattern

<intercept-url pattern="/logList/*" access="ROLE_ADMIN" /> then it will work.

Here are tests (Note that with RegexRequestMatcher, same pattern works for both /logList/ and /logList):

    @Test
public void antTest1() throws Exception {

    AntPathRequestMatcher pathMatcher = new AntPathRequestMatcher("/loglist*");
    MockHttpServletRequest mockRequest = new MockHttpServletRequest();
     mockRequest.setScheme("http");
     mockRequest.setPathInfo("/logList");
    Assert.assertThat(pathMatcher.matches(mockRequest), is(true));
}

@Test
public void antTest2() throws Exception {


    AntPathRequestMatcher pathMatcher = new AntPathRequestMatcher("/loglist/*");
    MockHttpServletRequest mockRequest = new MockHttpServletRequest();
     mockRequest.setScheme("http");
     mockRequest.setPathInfo("/logList/");
    Assert.assertThat(pathMatcher.matches(mockRequest), is(true));
}

@Test
public void regexTest3() throws Exception {

    RegexRequestMatcher pathMatcher = new RegexRequestMatcher("/logList.*", "GET");
    MockHttpServletRequest mockRequest = new MockHttpServletRequest();
     mockRequest.setScheme("http");
     mockRequest.setMethod("GET");
     mockRequest.setPathInfo("/logList/");
    Assert.assertThat(pathMatcher.matches(mockRequest), is(true));
}

@Test
public void regexTest4() throws Exception {

    RegexRequestMatcher pathMatcher = new RegexRequestMatcher("/logList.*", "GET");
    MockHttpServletRequest mockRequest = new MockHttpServletRequest();
     mockRequest.setScheme("http");
     mockRequest.setMethod("GET");
     mockRequest.setPathInfo("/logList");
    Assert.assertThat(pathMatcher.matches(mockRequest), is(true));
}

To use RegexRequestMatcher, add attribute 'request-matcher' to http and set its value to 'regex':

<http auto-config="true" request-matcher="regex">


Does pattern="/logList/**" make a difference?

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜