Question

我的问题是：当我尝试在我的自定义登录页面上登录时，它将我重新导向登录页面（这不要紧，如果我把正确或错误的凭据）。在调试中我没有达到自定义的UserDetailService也很奇怪，我认为这意味着Spring甚至不检查用户的凭证。

我有自定义登录表单/WEB-INF/jsp/login.jsp：

...  
<form name='loginForm' action="<c:url value='j_spring_security_check' />" method='POST'> 

     <table> 
      <tr> 
       <td>User:</td> 
       <td><input type='text' name='j_username' value=''></td> 
      </tr> 
      <tr> 
       <td>Password:</td> 
       <td><input type='password' name='j_password' /></td> 
      </tr> 
      <tr> 
       <td colspan='2'><input name="submit" type="submit" 
             value="submit" /></td> 
      </tr> 
     </table> 

     <input type="hidden" name="${_csrf.parameterName}" 
       value="${_csrf.token}" /> 

    </form> 
... 

这是配置：

@Configuration 
@EnableWebMvcSecurity 
public class WebSecurityConfig extends WebSecurityConfigurerAdapter { 

    @Autowired 
    private UserDetailsService userDetailsService; 

    @Override 
    protected void configure(HttpSecurity http) throws Exception { 
     http 
       .authorizeRequests().antMatchers("/", "/welcome", "/resources/**").permitAll() 
       .anyRequest().authenticated().and() 
       .formLogin().loginPage("/login").failureUrl("/login?error").permitAll().and() 
       .logout().logoutUrl("/login?logout").permitAll(); 
    } 

    @Autowired 
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
     auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder()); 
    } 

    @Bean 
    public PasswordEncoder passwordEncoder() { 
     return new BCryptPasswordEncoder(); 
    } 
} 

这是内部控制：

@RequestMapping(value = "/login", method = RequestMethod.GET) 
public ModelAndView login(
     @RequestParam(value = "error", required = false) String error, 
     @RequestParam(value = "logout", required = false) String logout) { 

    ModelAndView model = new ModelAndView(); 
    if (error != null) { 
     model.addObject("error", "Invalid username and password!"); 
    } 

    if (logout != null) { 
     model.addObject("msg", "You've been logged out successfully."); 
    } 
    model.setViewName("login"); 

    return model; 

} 

在src/main/resources/application.properties我：

spring.view.prefix: /WEB-INF/jsp/ 
spring.view.suffix: .jsp 

Answer 1

那些j_spring_security_check，j_username,j_password名称都是旧的默认值（Spring Security 3.2之前的版本）。

现在的默认值是：login,username和password。