spring security 使用自定義AuthenticationFailureHandler無法跳轉failureUrl

默認AuthenticationFailureHandler源碼

• org.springframework.security.config.annotation.web.configurers.AbstractAuthenticationFilterConfigurer

protected final void updateAuthenticationDefaults() {
	if (loginProcessingUrl == null) {
		loginProcessingUrl(loginPage);
	}
	if (failureHandler == null) {
		// 默認使用/login?error
		failureUrl(loginPage + "?error");
	}

	final LogoutConfigurer<B> logoutConfigurer = getBuilder().getConfigurer(
			LogoutConfigurer.class);
	if (logoutConfigurer != null && !logoutConfigurer.isCustomLogoutSuccess()) {
		logoutConfigurer.logoutSuccessUrl(loginPage + "?logout");
	}
}
public final T failureUrl(String authenticationFailureUrl) {
	// 默認使用SimpleUrlAuthenticationFailureHandler
	T result = failureHandler(new SimpleUrlAuthenticationFailureHandler(
			authenticationFailureUrl));
	// 此處保存失敗url
	this.failureUrl = authenticationFailureUrl;
	return result;
}
protected final void updateAccessDefaults(B http) {
	// 如果設置了permitAll,此處將設置保存的failureUrl為permitAll
	if (permitAll) {
		PermitAllSupport.permitAll(http, loginPage, loginProcessingUrl, failureUrl);
	}
}

• org.springframework.security.config.annotation.web.configurers.PermitAllSupport

public static void permitAll(
	HttpSecurityBuilder<? extends HttpSecurityBuilder<?>> http, String... urls) {
	for (String url : urls) {
		if (url != null) {
			// 此處使用的是完全匹配規則，因此/login與/login?error需要兩條匹配規則
			permitAll(http, new ExactUrlRequestMatcher(url));
		}
	}
}
private final static class ExactUrlRequestMatcher implements RequestMatcher {
	private String processUrl;

	private ExactUrlRequestMatcher(String processUrl) {
		this.processUrl = processUrl;
	}

	public boolean matches(HttpServletRequest request) {
		String uri = request.getRequestURI();
		String query = request.getQueryString();

		if (query != null) {
			uri += "?" + query;
		}
		// 必須uri與query完全匹配
		if ("".equals(request.getContextPath())) {
			return uri.equals(processUrl);
		}

		return uri.equals(request.getContextPath() + processUrl);
	}

	@Override
	public String toString() {
		StringBuilder sb = new StringBuilder();
		sb.append("ExactUrl [processUrl='").append(processUrl).append("']");
		return sb.toString();
	}
}

使用自定義AuthenticationFailureHandler

• org.springframework.security.config.annotation.web.configurers.AbstractAuthenticationFilterConfigurer

public final T failureHandler(
		AuthenticationFailureHandler authenticationFailureHandler) {
	// 此處清空了保存的failureUrl
	this.failureUrl = null;
	this.failureHandler = authenticationFailureHandler;
	return getSelf();
}

總結

1. 如果使用自定義AuthenticationFailureHandler繼承SimpleUrlAuthenticationFailureHandler或進行類似的頁面跳轉，
   需在WebSecurityConfigurerAdapter中額外配置失敗跳轉url的訪問控制規則

http.authorizeRequests().antMatchers("/login?error").permitAll()