blocks|key|183116|text|请参阅LoginUrlAuthenticationEntryPoint中的方法buildRedirectUrlToLoginPage(HttpServletRequest+request,+...)。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|183117|如果我正确理解了您想要实现的目标，我认为在子类中重写此方法，复制原始方法，但在构建url时额外调用urlBuilder.setQuery(request.getQueryString())就足够了。|183118|然后，您只需使用此自定义入口点配置ExceptionTranslationFilter。|183119|entityMap^0|3|W|13|1O|0|1D|19|0|H|Q|0^^$0|@$1|2|3|4|5|6|7|L|8|@$9|M|A|N|B|C]|$9|O|A|P|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|Q|8|@$9|R|A|S|B|C]]|D|@]|E|$]]|$1|H|3|I|5|6|7|T|8|@$9|U|A|V|B|C]]|D|@]|E|$]]|$1|J|3|-4|5|6|7|W|8|@]|D|@]|E|$]]]|K|$]]

See the method <code>buildRedirectUrlToLoginPage(HttpServletRequest request, ...)</code> in <code>LoginUrlAuthenticationEntryPoint</code>.

If I understood correctly what you want to achieve, I think it should be enough to override this method in a sublclass, copy the original method, but additionally call <code>
urlBuilder.setQuery(request.getQueryString())</code> when it builds the url.

Then you only need to configure the <code>ExceptionTranslationFilter</code> with this customized entry point.

blocks|key|401117|text|根据@zagyi的响应，我只是重写了我现有的AuthenticationProcessingFilterEntryPoint扩展中的一个方法|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|401118|要覆盖的方法是由buildRedirectUrlToLoginPage(..调用的protected+String+determineUrlToUseForThisRequest(HttpServletRequest+request,+HttpServletResponse+response,+++++++++++++AuthenticationException+exception)|401119|@Override
protected+String+determineUrlToUseForThisRequest(HttpServletRequest+request,+HttpServletResponse+response,
++++++++AuthenticationException+exception)+{
++++String+url+=+super.determineUrlToUseForThisRequest(request,+response,+exception);
++++return+url+%2B+"?"+%2B+request.getQueryString();
}|code-block|syntax|javascript|401120|显然，这也可以改进为使用某种构建器，以迎合url上现有的查询字符串，但此时我知道我的登录url始终是/login/，所以这对我的目的来说很好。|401121|entityMap^0|M|14|0|8|U|15|49|0|0|1E|7|0^^$0|@$1|2|3|4|5|6|7|Q|8|@$9|R|A|S|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|T|8|@$9|U|A|V|B|C]|$9|W|A|X|B|C]]|D|@]|E|$]]|$1|H|3|I|5|J|7|Y|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|Z|8|@$9|10|A|11|B|C]]|D|@]|E|$]]|$1|O|3|-4|5|6|7|12|8|@]|D|@]|E|$]]]|P|$]]

as per @zagyi's response I just overrode a method in my existing extension of <code>AuthenticationProcessingFilterEntryPoint</code>

the method to override is <code>protected String determineUrlToUseForThisRequest(HttpServletRequest request, HttpServletResponse response,
 AuthenticationException exception)</code> which is called by <code>buildRedirectUrlToLoginPage(..</code>

<pre><code>@Override
protected String determineUrlToUseForThisRequest(HttpServletRequest request, HttpServletResponse response,
 AuthenticationException exception) {
 String url = super.determineUrlToUseForThisRequest(request, response, exception);
 return url + "?" + request.getQueryString();
}
</code></pre>

obviously that could be improved to also use a builder of sorts, catering for an existing query string on the url, but at this time I know my login url is always <code>/login/</code>, so this is fine for my purposes

blocks|key|401157|text|嗨，kabal+-|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|401158|我有非常相似的需求，我关注了你和zagyi的帖子和lion's的帖子，但我似乎仍然遗漏了/login页面上的原始请求参数。|401159|这就是我所拥有的：|401160|public+class+AuthenticationProcessingFilterEntryPoint+extends+LoginUrlAuthenticationEntryPoint+{
++++@Override
++++protected+String+determineUrlToUseForThisRequest(HttpServletRequest+request,+HttpServletResponse+response,+AuthenticationException+exception)+{
++++++++String+url+=+super.determineUrlToUseForThisRequest(request,+response,+exception);
++++++++return+url+%2B+"?"+%2B+request.getQueryString();
++++}
}



protected+void+configure(final+HttpSecurity+httpSecurity)+throws+Exception+{
++++httpSecurity.
++++formLogin().loginPage("/signIn").permitAll().
++++++++and().
++++++++++++authorizeRequests().
++++++++++++antMatchers(managementContextPath+%2B+"/**").permitAll().
++++++++++++anyRequest().authenticated().withObjectPostProcessor(objectPostProcessor).
++++++++and().
++++++++++++csrf().disable().
++++++++++++contentTypeOptions().
++++++++++++xssProtection().
++++++++++++cacheControl().
++++++++++++httpStrictTransportSecurity().
++++++++and().
++++++++++++requestCache().requestCache(new+RedisRequestCache(savedRequestRedisTemplate())).
++++++++and().
++++++++++++sessionManagement().sessionAuthenticationStrategy(sessionAuthenticationStrategy).
++++++++and().
++++++++++++addFilter(new+ExceptionTranslationFilter(new+AuthenticationProcessingFilterEntryPoint()));
}|code-block|syntax|javascript|401161|我可以看到部署了AuthenticationProcessingFilterEntryPoint，但它并没有命中断点。|401162|基于documentation，这似乎只有在有AuthenticationException或AccessDeniedException时才会生效。在上面的配置中，我不确定当发生这种情况时，spring内部是否会抛出这样的异常。|401163|此外，无论身份验证成功与否，我都希望保留登录页面上的查询参数。|401164|我添加了success和failure处理程序，但它们都不起作用。|401165|protected+void+configure(final+HttpSecurity+httpSecurity)+throws+Exception+{
++++httpSecurity.
++++formLogin().
++++++++successHandler(new+PropogateQueryStringAuthenticationSuccessHandlerImpl()).
++++++++failureHandler(new+SimpleUrlAuthenticationFailureHandlerImpl(new+QueryStringPropagateRedirectStrategy())).
++++and().
++++++++authorizeRequests().
++++++++antMatchers(managementContextPath+%2B+"/**").permitAll().
++++++++anyRequest().authenticated().withObjectPostProcessor(objectPostProcessor).
++++and().
++++++++csrf().disable().
++++++++contentTypeOptions().
++++++++xssProtection().
++++++++cacheControl().
++++++++httpStrictTransportSecurity().
++++and().
++++++++requestCache().requestCache(new+RedisRequestCache(savedRequestRedisTemplate())).
+++++and().
++++++++sessionManagement().sessionAuthenticationStrategy(sessionAuthenticationStrategy);
}|401166|我在spring+boot+1.1.6.RELEASE上使用spring-security+3.2.4.RELEASE+(它使用Spring框架4.0.7.RELEASE)|401167|谢谢你，三|401168|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/users/818316/kabal|1|https://stackoverflow.com/users/1276804/zagyi|2|https://stackoverflow.com/users/1037210/lion|3|http://docs.spring.io/spring-security/site/docs/3.2.5.RELEASE/reference/htmlsingle/#exception-translation-filter^0|2|5|0|0|G|5|1|P|6|2|0|0|0|0|2|D|3|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1E|8|@]|9|@$A|1F|B|1G|1|1H]]|C|$]]|$1|D|3|E|5|6|7|1I|8|@]|9|@$A|1J|B|1K|1|1L]|$A|1M|B|1N|1|1O]]|C|$]]|$1|F|3|G|5|6|7|1P|8|@]|9|@]|C|$]]|$1|H|3|I|5|J|7|1Q|8|@]|9|@]|C|$K|L]]|$1|M|3|N|5|6|7|1R|8|@]|9|@]|C|$]]|$1|O|3|P|5|6|7|1S|8|@]|9|@$A|1T|B|1U|1|1V]]|C|$]]|$1|Q|3|R|5|6|7|1W|8|@]|9|@]|C|$]]|$1|S|3|T|5|6|7|1X|8|@]|9|@]|C|$]]|$1|U|3|V|5|J|7|1Y|8|@]|9|@]|C|$K|L]]|$1|W|3|X|5|6|7|1Z|8|@]|9|@]|C|$]]|$1|Y|3|Z|5|6|7|20|8|@]|9|@]|C|$]]|$1|10|3|-4|5|6|7|21|8|@]|9|@]|C|$]]]|11|$12|$5|13|14|15|C|$16|17]]|18|$5|13|14|15|C|$16|19]]|1A|$5|13|14|15|C|$16|1B]]|1C|$5|13|14|15|C|$16|1D]]]]

Hi <a href="https://stackoverflow.com/users/818316/kabal">kabal</a> - 

I have very similar requirements, and I followed yours and <a href="https://stackoverflow.com/users/1276804/zagyi">zagyi</a>'s and <a href="https://stackoverflow.com/users/1037210/lion">lion's</a> post, but I still seem to loose the original request parameter on /login page. 

Here's what I have:

<pre><code>public class AuthenticationProcessingFilterEntryPoint extends LoginUrlAuthenticationEntryPoint {
 @Override
 protected String determineUrlToUseForThisRequest(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) {
 String url = super.determineUrlToUseForThisRequest(request, response, exception);
 return url + "?" + request.getQueryString();
 }
}



protected void configure(final HttpSecurity httpSecurity) throws Exception {
 httpSecurity.
 formLogin().loginPage("/signIn").permitAll().
 and().
 authorizeRequests().
 antMatchers(managementContextPath + "/**").permitAll().
 anyRequest().authenticated().withObjectPostProcessor(objectPostProcessor).
 and().
 csrf().disable().
 contentTypeOptions().
 xssProtection().
 cacheControl().
 httpStrictTransportSecurity().
 and().
 requestCache().requestCache(new RedisRequestCache(savedRequestRedisTemplate())).
 and().
 sessionManagement().sessionAuthenticationStrategy(sessionAuthenticationStrategy).
 and().
 addFilter(new ExceptionTranslationFilter(new AuthenticationProcessingFilterEntryPoint()));
}
</code></pre>

I can see that AuthenticationProcessingFilterEntryPoint is deployed, but it does not hit a breakpoint there. 

Based on the <a href="http://docs.spring.io/spring-security/site/docs/3.2.5.RELEASE/reference/htmlsingle/#exception-translation-filter" rel="nofollow noreferrer">documentation</a>, it appears that this will kick in only when there is AuthenticationException or AccessDeniedException. In the configuration above, I am not sure if the spring internally throws such exception when such happens. 

Additionally, I'd like to to preserve the query parameter on the landing page regardless authentication succeeds or not. 

I did add success and failure handler, but none would kick into action. 

<pre><code>protected void configure(final HttpSecurity httpSecurity) throws Exception {
 httpSecurity.
 formLogin().
 successHandler(new PropogateQueryStringAuthenticationSuccessHandlerImpl()).
 failureHandler(new SimpleUrlAuthenticationFailureHandlerImpl(new QueryStringPropagateRedirectStrategy())).
 and().
 authorizeRequests().
 antMatchers(managementContextPath + "/**").permitAll().
 anyRequest().authenticated().withObjectPostProcessor(objectPostProcessor).
 and().
 csrf().disable().
 contentTypeOptions().
 xssProtection().
 cacheControl().
 httpStrictTransportSecurity().
 and().
 requestCache().requestCache(new RedisRequestCache(savedRequestRedisTemplate())).
 and().
 sessionManagement().sessionAuthenticationStrategy(sessionAuthenticationStrategy);
}
</code></pre>

I am using spring-security 3.2.4.RELEASE on spring boot 1.1.6.RELEASE(which in turn uses Spring framework 4.0.7.RELEASE) 

Thanks, 
San

ok.

lets say I have a secure url pattern

<pre><code>/secure/link-profile
</code></pre>

optionally, there can be url paramaters appended.

<pre><code>/secure/link-profile?firstName=Bob&amp;secondName=Smith&amp;membershipNumber=1234
</code></pre>

how can I make it so that those url params are carried over to the login page?

<pre><code>/login?firstName=Bob&amp;secondName=Smith&amp;membershipNumber=1234
</code></pre>

the basic premise is that we offer rewards integration with a 3rd party, who will send their users to us. They will be taken to a page to link their 3rd party account/profile with their/our website user. If however, they dont have an existing account with us, then on the login page, they will go to the signup page, and we would then like to prepopulate some of their details that the 3rd party has passed on to us.

thanks in advance

spring security 2.0.7.RELEASE
spring framework 3.1.1.RELEASE

Spring Security - Retaining URL parameters on redirect to login

身份验证

好的。假设我有一个安全的url模式。/secure/link-profile可选地，可以附加url参数。/secure/link-profile?firstName=Bob&secondName=Smith&membershipNumber=1234我如何才能使这些url参数被带到登录页面？/login?firstNa...

问Spring Security -在重定向到登录时保留URL参数
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Spring Security -在重定向到登录时保留URL参数EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Spring Security -在重定向到登录时保留URL参数
EN