У меня есть веб-приложение Spring Boot, в котором возникают проблемы с аутентификацией. После того, как я вставил правильное имя пользователя и пароль, форма отправляется и возвращается в форму входа в систему.
Я пытался отладить и посмотреть, что происходит, но я не могу понять. Любая помощь приветствуется.
Это мой класс конфигурации безопасности.
private static final String[] PUBLIC_MATCHERS = {
"/webjars/**,
"/css/**,
"/js/**,
...
}
http
.sessionManagement()
.maximumSessions(100)
.maxSessionsPreventsLogin(false)
.expiredUrl("/expired-url")
.sessionRegistry(securityBeans.sessionRegistry());
http
.authorizeRequests()
.antMatchers(PUBLIC_MATCHERS).permitAll()
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/login").permitAll()
.defaultSuccessUrl("/dashboard")
.and()
.logout()
.logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
.logoutSuccessUrl("/login?logout")
.deleteCookies("remember-me").deleteCookies("JSESSIONID")
.invalidateHttpSession(true).permitAll()
.and()
.httpBasic();
А журналы после отправки форм при отладке выглядят следующим образом.
2020-01-28 18:10:45.398 INFO 29168 --- [nio-8080-exec-3] Spring Security Debugger :
************************************************************
Request received for POST '/login':
org.apache.catalina.connector.RequestFacade@442276e5
servletPath:/login
pathInfo:null
headers:
host: localhost:8080
connection: keep-alive
content-length: 69
cache-control: max-age=0
origin: http://localhost:8080
upgrade-insecure-requests: 1
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: http://localhost:8080/login
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: JSESSIONID=5F80F076DD57E7CDE52F1B24EC1BB8EF
Security filter chain: [
WebAsyncManagerIntegrationFilter
SecurityContextPersistenceFilter
HeaderWriterFilter
LogoutFilter
UsernamePasswordAuthenticationFilter
ConcurrentSessionFilter
BasicAuthenticationFilter
RequestCacheAwareFilter
SecurityContextHolderAwareRequestFilter
AnonymousAuthenticationFilter
SessionManagementFilter
ExceptionTranslationFilter
FilterSecurityInterceptor
]
************************************************************
Hibernate:
select
user0_.id as id1_14_,
user0_.created_at as created_2_14_,
user0_.created_by as created_3_14_,
2020-01-28 18:10:46.155 INFO 29168 --- [io-8080-exec-10] Spring Security Debugger :
************************************************************
Request received for GET '/dashboard':
org.apache.catalina.connector.RequestFacade@442276e5
servletPath:/dashboard
pathInfo:null
headers:
host: localhost:8080
connection: keep-alive
cache-control: max-age=0
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: http://localhost:8080/login
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: JSESSIONID=4244FB8F7CE22B64766E8E97B6CB97EC
************************************************************
2020-01-28 18:10:46.168 INFO 29168 --- [nio-8080-exec-4] Spring Security Debugger :
************************************************************
Request received for GET '/login':
org.apache.catalina.connector.RequestFacade@442276e5
servletPath:/login
pathInfo:null
headers:
host: localhost:8080
connection: keep-alive
cache-control: max-age=0
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-origin
sec-fetch-mode: navigate
referer: http://localhost:8080/login
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cookie: JSESSIONID=4244FB8F7CE22B64766E8E97B6CB97EC
Пример ответа здесь после его возврата в браузер
Request URL: http://localhost:8080/login
Request Method: POST
Status Code: 302 /
- Request Headers
Accept: text/html, application/xhtml+xml, application/xml; q=0.9, */*; q=0.8
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cache-Control: max-age=0
Content-Length: 109
Content-Type: application/x-www-form-urlencoded
Cookie: JSESSIONID=9FFAEA5655FE807B88490B358E89894D
Host:localhost:8080
Referer: http://localhost:8080/login
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18362
- Response Headers
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-length: 0
date: Wed, 29 Jan 2020 07:20:35 GMT
expires: 0
location: http://localhost:8080/login
pragma: no-cache
server: nginx/1.16.1
set-cookie: JSESSIONID=68D2982DB1B8022C2EBED7A05C96D67B; Path=/; HttpOnly
x-content-type-options: nosniff
x-frame-options: DENY
x-xss-protection: 1; mode=block
Маркер CSRF не привязан к запросу, даже если он введен в форму входа 
<form class="form-horizontal form-material" id="loginform"
method="post"
th:action="@{/login}">
<h3 class="text-center m-b-10">Sign In</h3>
<div class="form-group ">
<div class="col-xs-12">
<input autofocus class="form-control" id="username"
name="username" placeholder="Email" required type="email">
</div>
</div>
<div class="form-group ">
<div class="col-xs-12">
<input class="form-control" id="password"
name="password"
placeholder="Password" required
th:placeholder="#{login.password.text}" type="password">
</div>
</div>
<div class="form-group row">
<div class="col-md-12">
<div class="d-flex no-block align-items-center">
<div class="custom-control custom-checkbox">
<input checked class="custom-control-input" id="remember-me"
name="remember-me" type="checkbox">
<label class="custom-control-label" for="remember-me">Remember me</label>
</div>
<div class="ml-auto">
<a class="text-muted" href="javascript:void(0)" id="to-recover"><i
class="fas fa-lock m-r-5"></i> Forgot pwd?</a>
</div>
</div>
</div>
</div>
<div class="form-group text-center p-b-0">
<div class="col-xs-12">
<button class="btn btn-info btn-lg btn-block btn-rounded text-uppercase waves-effect waves-light"
type="submit">Log In
</button>
</div>
</div>
<div class="form-group m-b-0">
<div class="col-sm-12 text-center">
Don't have an account? <a
class="text-info m-l-5"
th:href="@{/sign-up}"><b>Sign
Up</b></a> <a class="float-right" th:href="@{/}">Home</a>
</div>
</div>
</form>