web-dev-qa-db-fra.com

Spring Security - L'accès est refusé (l'utilisateur n'est pas anonyme) spring-security-core-4.0.3.RELEASE

quelqu'un peut-il voir un échec dans ce fichier Spring Security Config?

Après la connexion, j'obtiens un message de débogage:

L'accès est refusé (l'utilisateur n'est pas anonyme); délégation à AccessDeniedHandler org.springframework.security.access.AccessDeniedException: l'accès est refusé

mais je peux accéder à l'application.

     @Override
  protected void configure(HttpSecurity http) throws Exception {
    http.
      authorizeRequests().antMatchers("/register/verification/*/*").anonymous()
      .and().authorizeRequests().antMatchers("/register/test").anonymous()
      .and().authorizeRequests().antMatchers("/register").anonymous()
      .and().authorizeRequests().antMatchers("/forgot_password").anonymous().and().authorizeRequests().antMatchers("/triggeredBy/password**").permitAll()
      .and().authorizeRequests().antMatchers("/err/403").permitAll()
      .and().authorizeRequests().antMatchers("/login").anonymous()
      .and().authorizeRequests().anyRequest().authenticated()
      .and().formLogin().loginPage("/login").defaultSuccessUrl("/landingPage", true).failureUrl("/login?error=true").usernameParameter(
      "username").passwordParameter("password").and().logout().logoutUrl("/logout").logoutSuccessUrl("/login?logout").and()
      .rememberMe().rememberMeCookieName("REMEMBER_ME").rememberMeParameter("remember_me").tokenValiditySeconds(123456).key(
      "49874795145977617241")
      .and().exceptionHandling().accessDeniedPage("/err/403");
  }

Trace de la pile:

2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/js/**'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/forgot_password'
2016-01-11 12:09:17.826 DEBUG 1372 --- [io-8080-exec-10] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/err/403'; against '/js/**'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-3] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/images/**']
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/triggeredby/password**'
2016-01-11 12:09:17.826 DEBUG 1372 --- [io-8080-exec-10] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/err/403'; against '/img/**'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/images/**'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/err/403'
2016-01-11 12:09:17.826 DEBUG 1372 --- [io-8080-exec-10] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/err/403'; against '/fonts/**'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-3] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/**/favicon.ico']
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-7] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/login'
2016-01-11 12:09:17.826 DEBUG 1372 --- [io-8080-exec-10] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/err/403'; against '/favicon.ico'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/**/favicon.ico'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-7] o.s.s.w.a.i.FilterSecurityInterceptor    : Secure object: FilterInvocation: URL: /login; Attributes: [anonymous]
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [io-8080-exec-10] o.s.security.web.FilterChainProxy        : /err/403 at position 1 of 13 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-3] o.s.s.web.util.matcher.OrRequestMatcher  : Trying to match using Ant [pattern='/error']
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-7] o.s.s.w.a.i.FilterSecurityInterceptor    : Previously Authenticated: org.springframework.security.authentication.UsernamePasswordAuthenticationToken@18b68a6c: Principal: de.upb.msapp.web.model.profiles.Profile@2; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2eb76: RemoteIpAddress: 127.0.0.1; SessionId: E46776770A1C922CDF1A00121BB6A4E3; Granted Authorities: ROLE_PATIENT, ROLE_PROFILE
2016-01-11 12:09:17.826 DEBUG 1372 --- [io-8080-exec-10] o.s.security.web.FilterChainProxy        : /err/403 at position 2 of 13 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/error'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-7] o.s.s.access.vote.AffirmativeBased       : Voter: org.springframework.security.web.access.expression.WebExpressionVoter@5b5cddbb, returned: -1
2016-01-11 12:09:17.826 DEBUG 1372 --- [io-8080-exec-10] o.s.security.web.FilterChainProxy        : /err/403 at position 3 of 13 in additional filter chain; firing Filter: 'HeaderWriterFilter'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-3] o.s.s.web.util.matcher.OrRequestMatcher  : No matches found
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [io-8080-exec-10] o.s.security.web.FilterChainProxy        : /err/403 at position 4 of 13 in additional filter chain; firing Filter: 'CsrfFilter'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/static/**'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [io-8080-exec-10] o.s.security.web.FilterChainProxy        : /err/403 at position 5 of 13 in additional filter chain; firing Filter: 'LogoutFilter'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/resources/**'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [io-8080-exec-10] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /err/403' doesn't match 'POST /logout
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/uploads/**'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [io-8080-exec-10] o.s.security.web.FilterChainProxy        : /err/403 at position 6 of 13 in additional filter chain; firing Filter: 'UsernamePasswordAuthenticationFilter'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/css/**'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [io-8080-exec-10] o.s.s.w.u.matcher.AntPathRequestMatcher  : Request 'GET /err/403' doesn't match 'POST /login
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/js/**'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [io-8080-exec-10] o.s.security.web.FilterChainProxy        : /err/403 at position 7 of 13 in additional filter chain; firing Filter: 'RequestCacheAwareFilter'
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.826 DEBUG 1372 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/img/**'
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.827 DEBUG 1372 --- [io-8080-exec-10] o.s.security.web.FilterChainProxy        : /err/403 at position 8 of 13 in additional filter chain; firing Filter: 'SecurityContextHolderAwareRequestFilter'
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/fonts/**'
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.827 DEBUG 1372 --- [io-8080-exec-10] o.s.security.web.FilterChainProxy        : /err/403 at position 9 of 13 in additional filter chain; firing Filter: 'RememberMeAuthenticationFilter'
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-3] o.s.s.w.u.matcher.AntPathRequestMatcher  : Checking match of request : '/login'; against '/favicon.ico'
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.827 DEBUG 1372 --- [io-8080-exec-10] s.s.w.a.r.RememberMeAuthenticationFilter : SecurityContextHolder not populated with remember-me token, as it already contained: 'org.springframework.security.authentication.UsernamePasswordAuthenticationToken@18b68a6c: Principal: de.upb.msapp.web.model.profiles.Profile@2; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2eb76: RemoteIpAddress: 127.0.0.1; SessionId: E46776770A1C922CDF1A00121BB6A4E3; Granted Authorities: ROLE_PATIENT, ROLE_PROFILE'
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /login at position 1 of 13 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter'
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.827 DEBUG 1372 --- [io-8080-exec-10] o.s.security.web.FilterChainProxy        : /err/403 at position 10 of 13 in additional filter chain; firing Filter: 'AnonymousAuthenticationFilter'
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-3] o.s.security.web.FilterChainProxy        : /login at position 2 of 13 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter'
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.827 DEBUG 1372 --- [io-8080-exec-10] o.s.s.w.a.AnonymousAuthenticationFilter  : SecurityContextHolder not populated with anonymous token, as it already contained: 'org.springframework.security.authentication.UsernamePasswordAuthenticationToken@18b68a6c: Principal: de.upb.msapp.web.model.profiles.Profile@2; Credentials: [PROTECTED]; Authenticated: true; Details: org.springframework.security.web.authentication.WebAuthenticationDetails@2eb76: RemoteIpAddress: 127.0.0.1; SessionId: E46776770A1C922CDF1A00121BB6A4E3; Granted Authorities: ROLE_PATIENT, ROLE_PROFILE'
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-5] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-7] o.s.s.w.a.ExceptionTranslationFilter     : Access is denied (user is not anonymous); delegating to AccessDeniedHandler

org.springframework.security.access.AccessDeniedException: Access is denied
    at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.Java:83) ~[spring-security-core-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.Java:232) ~[spring-security-core-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.Java:123) ~[spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.Java:90) ~[spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.Java:330) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.Java:114) ~[spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.Java:330) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.Java:122) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.Java:330) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.Java:111) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.Java:330) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.Java:157) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.Java:330) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.Java:169) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.Java:330) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.Java:48) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.Java:330) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.Java:205) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.Java:330) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.Java:120) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.Java:330) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.Java:96) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.Java:107) [spring-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.Java:330) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.Java:64) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.Java:107) [spring-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.Java:330) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.Java:91) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.Java:330) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.Java:53) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.Java:107) [spring-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.Java:330) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.Java:213) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.Java:176) [spring-security-web-4.0.3.RELEASE.jar:4.0.3.RELEASE]
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.Java:346) [spring-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.Java:262) [spring-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]
    at org.Apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.Java:239) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.Java:206) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.Java:99) [spring-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.Java:107) [spring-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]
    at org.Apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.Java:239) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.Java:206) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.Java:87) [spring-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.Java:107) [spring-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]
    at org.Apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.Java:239) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.Java:206) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.Java:77) [spring-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.Java:107) [spring-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]
    at org.Apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.Java:239) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.Java:206) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.Java:121) [spring-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.Java:107) [spring-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]
    at org.Apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.Java:239) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.Java:206) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.springframework.boot.actuate.autoconfigure.MetricsFilter.doFilterInternal(MetricsFilter.Java:103) [spring-boot-actuator-1.3.1.RELEASE.jar:1.3.1.RELEASE]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.Java:107) [spring-web-4.2.4.RELEASE.jar:4.2.4.RELEASE]
    at org.Apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.Java:239) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.Java:206) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.Java:212) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.catalina.core.StandardContextValve.invoke(StandardContextValve.Java:106) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.Java:502) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.catalina.core.StandardHostValve.invoke(StandardHostValve.Java:141) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.Java:79) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.Java:88) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.Java:521) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.Java:1096) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.Java:674) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.Tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.Java:1500) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at org.Apache.Tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.Java:1456) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at Java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.Java:1142) [na:1.8.0_60]
    at Java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.Java:617) [na:1.8.0_60]
    at org.Apache.Tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.Java:61) [Tomcat-embed-core-8.0.30.jar:8.0.30]
    at Java.lang.Thread.run(Thread.Java:745) [na:1.8.0_60]

2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-9] tRepository$SaveToSessionResponseWrapper : Skip invoking on
2016-01-11 12:09:17.827 DEBUG 1372 --- [nio-8080-exec-8] tRepository$SaveToSessionResponseWrapper : Skip invoking on
javaspringsecurityspring-mvcspring-security
14
Tim Schwalbe

À partir de la documentation Spring Security

anonyme () Spécifiez que les URL sont autorisées par les utilisateurs anonymes.

Jetons un œil à certains de vos codes:

.and().authorizeRequests().antMatchers("/login").anonymous()

Vous dites au système d'autoriser uniquement les utilisateurs anonymes (ROLE_ANONYMOUS) À pouvoir appeler le mappage /login.

Lorsque vous vous connectez avec votre utilisateur, l'utilisateur a un autre rôle et n'est plus anonyme. Pour cet exemple de code, vous devez utiliser permitAll().

Il est fort probable que vous souhaitiez également utiliser permitAll() sur d'autres équivalents de requête et dans votre cas, j'utiliserais également un seul mappage pour /login -> formLogin().

8
kamwo

Cela a fonctionné pour moi - hasAuthority("ROLE_USER")

Essayez avec @RolesAllowed("USER") au lieu de @RolesAllowed("ROLE_USER"). Finalement, vous pourriez utiliser hasAuthority("ROLE_USER") ou hasRole("USER") au lieu de hasRole("ROLE_USER").

6
prashanth yet

La solution est que le

img.img-round.img-responsive (alt = 'Avatar', src = "# {_ contextPath} # {profile.avatarPath}")

avait tort. Après avoir obtenu le bon chemin, cela fonctionne pour moi.

1
Tim Schwalbe

Vous définissez simplement cette URL comme ignorée par la sécurité?

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(WebSecurity web) throws Exception {

    web.ignoring().antMatchers("/layouts/**", "/styles/**", "/spring/login");
    }
    ...
0
Iakov Senatov