Yay güvenliği, giriş yaptıktan sonra http'a geçiyor. Https'yi nasıl saklayabilirim?

Question

Spring MVC ve Spring Security kullanıyorum. Bu gönderiyi bulana kadar yönlendirmelerim https'yi http olarak değiştiriyordu. Spring MVC "redirect:" prefix always redirects to http -- how do I make it stay on https?. Ayrıca, AjaxUrlBasedViewResolver uygulamasında redirectHttp10Compatible özelliğini false olarak ayarladım.

Sorun, https hala giriş yaptıktan sonra http değerine geçmesidir. Giriş yaptıktan sonra, adresimi adres çubuğuna https olarak geri yükleyebilir ve yapışır. Ayrıca, çoğu kullanıcı için IP kimlik doğrulaması kullanıyorum, bu durumda https yukarıdaki çözüme teşekkürler.

login_security_check veya bunun gibi bir şey için redirectHtp10Compatible eklemeye çalışıyorum ama takılıyorum. İşte benim güvenlik-config.xml.

<?xml version="1.0" encoding="UTF-8"?> 

<beans:beans xmlns="http://www.springframework.org/schema/security" 
     xmlns:beans="http://www.springframework.org/schema/beans" 
     xmlns:util="http://www.springframework.org/schema/util" 
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
     xmlns:context="http://www.springframework.org/schema/context" 
     xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
     http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd 
     http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.0.xsd 
     http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"> 

<global-method-security pre-post-annotations="enabled" /> 

<http auto-config='true' access-denied-page="/login"> 
    <intercept-url pattern="/static/styles/**" filters="none" /> 
    <intercept-url pattern="/static/scripts/**" filters="none" /> 

    <intercept-url pattern="/login/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
    <intercept-url pattern="/error/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
    <intercept-url pattern="/api/**" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
    <intercept-url pattern="/ajaxTimeOut" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
    <intercept-url pattern="/checkSystem" access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
    <intercept-url pattern="/adminUser/**" access="ROLE_SSADMIN" /> 
    <intercept-url pattern="/**" access="ROLE_USER" /> 

    <form-login login-page="/ajaxTimeOut" login-processing-url="/login_security_check" authentication-failure-url="/login?login_error=t" default-target-url="/" always-use-default-target="true" /> 
    <logout logout-url="/logout" logout-success-url="/"/> 
    <custom-filter position="PRE_AUTH_FILTER" ref="ipPreAuthFilter" /> 
</http> 

<beans:bean id="ipAuthDetailsSource" class="com.mydomain.security.IPBasedPreAuthenticatedDetailsSource" /> 

<beans:bean id="ipPreAuthFilter" class="com.mydomain.security.IPPreAuthenticationFilter"> 
    <beans:property name="authenticationManager" ref="preAuthManager" /> 
    <beans:property name="authenticationDetailsSource" ref="ipAuthDetailsSource" /> 
</beans:bean> 

<beans:bean id="preAuthManager" class="org.springframework.security.authentication.ProviderManager"> 
    <beans:property name="providers"> 
     <beans:list> 
      <beans:ref local="preAuthProvider"/> 
     </beans:list> 
    </beans:property> 
</beans:bean> 

<beans:bean id="preAuthProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"> 
    <beans:property name="preAuthenticatedUserDetailsService" ref="preAuthUserService" /> 
</beans:bean> 

<beans:bean id="preAuthUserService" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesUserDetailsService" /> 

<authentication-manager> 
    <authentication-provider user-service-ref="userService"> 
     <password-encoder ref="passwordEncoder" > 
      <salt-source user-property="salt" /> 
     </password-encoder> 
    </authentication-provider> 
</authentication-manager> 

<beans:bean id="userService" class="com.mydomain.security.UserServiceImpl" /> 
<beans:bean id="passwordEncoder" class="com.mydomain.security.PasswordEncoder"> 
    <beans:constructor-arg value="256" /> 
</beans:bean> 

teşekkürler.

Answer 1

düğümleri

aynen böyle

intercep-url içinde güvenli adresler gerektirir kanallı özellik ekleyin:

<intercept-url pattern="/**" access="ROLE_USER" requires-channel="https" />