Question

能否通过在春季安全区内检查现有的HttpSession来认证用户? 我希望用户在一份URL(http://example.com/auth)上通过化学文摘社认证,而不是通过其他URLs认证。例如,如果直接到,那么我就要检查一下HttpSession,如果他们有n入化学文摘社,则将退回401部未经许可的编码。如果他们已经上下页,并贴上标签,那么他们就会返回内容。主要原因是要避免在认证期间出现任何由化学文摘社引发的转头。

I am kind of new to Spring Security and can t figure out if I need a custom AuthenticationManager, AuthenticationEntryPoint, both, or something else. The AuthenticationManager doesn t have a way for me to access the HttpSession, and the AuthenticationEntryPoint doesn t seem to be the right place to implement this functionality.

任何想法?

Answer 1

Spring Security is not using HTTP session. Instead, you can easily call to this static method:

SecurityContextHolder.getContext().getAuthentication();

坦率地说,我认为,你需要使春天的安全正确,以避免对认证进行核实,并人工转向其他网页。

友情链接