Spring Boot Security Umleitung von der Fehlerseite zur Anmeldeseite Im Falle eines Authentifizierungsfehlers

Question

Ich habe Spring Security für meine Webanwendung konfiguriert, Implementiert benutzerdefinierte Authentifizierung Handler zur Authentifizierung der Benutzerdetails.

Seine wie erwartet, wenn die Authentifizierung erfolgreich ist, wenn die Authentifizierung fehlschlägt seine rufenden benutzerdefinierte Authentifizierungsfehler-Handler Umleitung Fehlerseite (in meinem Fall Login-Seite mit Fehlermeldung) danach wieder Umleiten es zur Login-Seite (ohne Meldung)

Unten ist meine Konfiguration (Lassen Sie mich wissen, was hier falsch ist)

@Configuration 
@EnableWebSecurity 
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter { 

    @Autowired 
    private CustomAuthenticationProvider authProvider; 

    @Autowired 
    private AuthSuccessHandler authHandler; 
    @Autowired 
    private AuthFailureHandler authFailureHandler; 


    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http.authorizeRequests() 
      .antMatchers("/resources/**","/rest/**") 
      .permitAll().anyRequest().authenticated() 
      .and() 
      .formLogin() 
      .loginPage("/login") 
      .successHandler(authHandler) 
      .failureHandler(authFailureHandler) 
      .usernameParameter("username").passwordParameter("password") 
      .permitAll() 
      .and().csrf().disable(); 
    } 

    @Autowired 
    protected void configureGlobal(AuthenticationManagerBuilder auth) { 

     auth.authenticationProvider(authProvider); 
    } 
} 

Success Handler 

@Component 
public class AuthSuccessHandler extends SimpleUrlAuthenticationSuccessHandler { 

    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy(); 
    @Override 
    protected void handle(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException { 
     redirectStrategy.sendRedirect(request, response, "/home"); 
    } 
} 


Failure Handler 

@Component 
public class AuthFailureHandler extends SimpleUrlAuthenticationFailureHandler{ 

    private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy(); 
    @Override 
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) 
      throws IOException, ServletException { 
     System.out.println("AuthFailureHandler.onAuthenticationFailure()"); 
     redirectStrategy.sendRedirect(request, response, "/login?msg=Bad Credentials"); 
    } 
} 


Custom Authentication Provider 

@Component 
public class CustomAuthenticationProvider implements AuthenticationProvider 
{ 
    public Authentication authenticate(Authentication authentication) throws AuthenticationException { 

     UsernamePasswordAuthenticationToken token = (UsernamePasswordAuthenticationToken) authentication; 
     String username = (String)token.getPrincipal(); 
     String password = (String) token.getCredentials(); // retrieve the password 
     System.out.println("username="+username+" password="+password); 
     flag = //autheticate logic 
     if(flag) { 
       List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>(); 
       authorities.add(new SimpleGrantedAuthority("ROLE_ONE")); 
       authorities.add(new SimpleGrantedAuthority("ROLE_TWO")); 
       return new UsernamePasswordAuthenticationToken(username, password, authorities); 
      } 
     else 
     throw new BadCredentialsException("401"); 
    } 

    public boolean supports(Class<?> object) { 
     return object.equals(UsernamePasswordAuthenticationToken.class); 
    } 
} 

Controller : 
Below is the controller configuration 

    @RequestMapping(value = "/login", method = RequestMethod.GET) 
     public ModelAndView login(@RequestParam(name="msg",required=false) String message) 
    { 
      System.out.println("HomeController.login()"+message); 
      return new ModelAndView("login","message",message); 
    } 

login.jsp

<form id='loginForm' method='GET' action='./login'> 
    <div class="login"> 
     <div id='errorMsg' class="hide alert alert-danger" role="alert"><strong><i class='fa fa-warning'></i> 
     <span id='errorTitle'></span></strong><span id='errorText'></span> 
     </div> 
     <div class="form-group"> 
     <label for='txtUserName' class="UsernamePassword">Username:</label> 
     <input name="username" type="email" class="form-control" value="" id="txtUserName" maxlength="100" /> 
     </div> 
     <div class="form-group"> 
     <label for='txtPassword' class="UsernamePassword">Password:</label> 
     <input value='' name="password" class="form-control" type="password" id="txtPassword" maxlength="100" /> 
     </div> 
     <div class="form-group">      
     <label> 
     <input checked type="checkbox" name="RememberMe" id="checkboxRememberMe"/> Remember My Information 
     </label> 
     </div> 
     <c:if test="${param.error != null}"> 
     <div class="alert alert-danger"> 
      <p>Invalid username and password.</p> 
     </div> 
     </c:if> 
     <c:if test="${param.logout != null}"> 
     <div class="alert alert-success"> 
      <p>You have been logged out successfully.</p> 
     </div> 
     </c:if> 
     <div> 
     <p>${message}</p> 
     </div> 
     <div> 
     <button id="btnLogin" class="btnBlue" style='width:100% !important' type='submit'>Login</button> 
     </div> 
     <div class="usernamePassword"> 
     <a href="#" onclick='forgotPassword()'>I forgot my username/password</a> 
     </div> 
    </div> 
</form> 

Answer 1

Es ist wirklich wichtig, dass die "/ login? Msg = Bad Credentials" zu einem authorizeRequests() hinzugefügt wird, ansonsten wird der Controller den Fehlerparameter nicht übernehmen.

@Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http.authorizeRequests() 
      .antMatchers("/resources/**","/rest/**,/login*").permitAll() 
      .anyRequest().authenticated() 
      .and() 
      .formLogin() 
      .loginPage("/login") 
      .successHandler(authHandler) 
      .failureHandler(authFailureHandler) 
      .usernameParameter("username").passwordParameter("password") 
      .permitAll() 
      .and().csrf().disable(); 
    } 

Answer 2

Versuchen Sie, diese config:

.formLogin() 
.loginPage("/login") 
.failureUrl("/login?error")