春のセキュリティでフィルタを使用し、フィルタで認証を行う方法

Question

私はSpringのセキュリティでアプリケーションを開発し、adminやcustomerのようなユーザの役割に従ってログインしましたが、app/j_spring_security_checkに記録されています。私は、認証とセキュリティでフィルタを実装し、すべてのURLをトレースしたい。私は何をあなたの実際の質問に見当もつかない

Answer 1

Security_configuration.java

csrfheaderfilter.java

import java.io.IOException; 

import javax.servlet.FilterChain; 
import javax.servlet.ServletException; 
import javax.servlet.http.Cookie; 
import javax.servlet.http.HttpServletRequest; 
import javax.servlet.http.HttpServletResponse; 

import org.springframework.security.web.csrf.CsrfToken; 
import org.springframework.web.filter.OncePerRequestFilter; 
import org.springframework.web.util.WebUtils; 

public class CsrfHeaderFilter extends OncePerRequestFilter { 
    @Override 
    protected void doFilterInternal(HttpServletRequest request, 
      HttpServletResponse response, FilterChain filterChain) 
      throws ServletException, IOException { 
     CsrfToken csrf = (CsrfToken) request.getAttribute(CsrfToken.class 
       .getName()); 
     if (csrf != null) { 
      Cookie cookie = WebUtils.getCookie(request, "CSRF-TOKEN"); 
      String token = csrf.getToken(); 
      if (cookie == null || token != null 
        && !token.equals(cookie.getValue())) { 
       cookie = new Cookie("CSRF-CSRF-TOKEN", token); 
       cookie.setPath("/main.html"); 
       cookie.setHttpOnly(true); 
       cookie.setMaxAge(20); 
       response.addCookie(cookie); 

      } 
     } 
     filterChain.doFilter(request, response); 
    } 
} 

csrfrequestmatcher.java

import java.util.regex.Pattern; 

import javax.servlet.http.HttpServletRequest; 

import org.springframework.security.web.util.matcher.RegexRequestMatcher; 
import org.springframework.security.web.util.matcher.RequestMatcher; 

/** 
* 
* The default functionality is to skip CSRF checking for GET method. This 
* functionality is lost when an explicit request matcher is provided. So, need 
* to make sure that GET methods are skipped manually. 
* 
*/ 

public class CsrfRequestMatcher implements RequestMatcher { 

    // Always allow the HTTP GET method 
    private Pattern allowedMethods = Pattern.compile("^GET$"); 
    private RegexRequestMatcher unprotectedMatcher = new RegexRequestMatcher(
      "/unprotected", null); 

    @Override 
    public boolean matches(HttpServletRequest request) { 

     // Skip checking if request method is a GET 
     if (allowedMethods.matcher(request.getMethod()).matches()) { 
      return false; 
     } 

     // Check CSRF in all other cases. 
     return !unprotectedMatcher.matches(request); 
    } 

}