Spring Security实现注册成功后免登录访问/order页面

核心思路 #

注册成功后，直接通过Spring Security的API完成用户认证，将认证信息存入SecurityContext，后续访问/order时会被判定为已登录状态，无需跳转登录页面。

具体修改步骤 #

1. 暴露AuthenticationManager Bean（修改WebSecurityConfig） #

在WebSecurityConfig中添加方法，暴露AuthenticationManager供控制器注入使用：

@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    // 原有代码...

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    // 原有configure方法...
}

2. 修改注册控制器，添加自动认证逻辑（修改RegisterController） #

注入所需依赖，并在注册保存方法中完成用户认证流程：

package r2s.com.controller;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;

import r2s.com.dto.CustomerDTO;
import r2s.com.models.CustomerEntity;
import r2s.com.service.CustomerService;

@Controller
public class RegisterController {
    
    @Autowired
    CustomerService customerService;
    
    @Autowired
    private AuthenticationManager authenticationManager;
    
    @Autowired
    private UserDetailsService userDetailsService;
    
    @Autowired
    private BCryptPasswordEncoder passwordEncoder;
    
    @RequestMapping("/register")
    String register(HttpServletRequest request, HttpSession session) {
        String referer = request.getHeader("Referer");
        session.setAttribute("redirectUrl", referer);
        return "Register";
    }
    
    @PostMapping("/register/save")
    String saveRegister(@ModelAttribute("newCustomer") CustomerDTO customerDTO, 
                        HttpServletRequest request, 
                        HttpSession session) {
        CustomerEntity customerEntity = new CustomerEntity();
        CustomerDTO customerDTO2 = new CustomerDTO();
        customerEntity = customerDTO2.convertCustomerEntity(customerDTO);
        
        // 使用注入的密码编码器，避免重复实例化
        String encryptedPwd = passwordEncoder.encode(customerEntity.getPassword());
        customerEntity.setPassword(encryptedPwd);
        
        // 保存用户到数据库
        CustomerEntity savedCustomer = customerService.save(customerEntity);
        
        // 加载用户详情（用于认证）
        UserDetails userDetails = userDetailsService.loadUserByUsername(savedCustomer.getUsername());
        
        // 创建认证Token，设置已认证状态
        UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
            userDetails,
            null, // 无需提供密码，直接认证通过
            userDetails.getAuthorities()
        );
        
        // 完成认证
        authenticationManager.authenticate(authToken);
        
        // 将认证信息存入SecurityContext
        SecurityContextHolder.getContext().setAuthentication(authToken);
        
        // 将SecurityContext存入Session，保持登录状态
        session.setAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, SecurityContextHolder.getContext());
        
        // 原有重定向逻辑
        String redirectUrl = (String) session.getAttribute("redirectUrl");
        session.removeAttribute("redirectUrl");
        if (redirectUrl != null && !redirectUrl.isEmpty()) {
            return "redirect:" + redirectUrl;
        } else {
            return "redirect:/";
        }
    }
}

3. 关键说明 #

• AuthenticationManager：负责处理认证请求，验证我们创建的Token有效性。
• SecurityContextHolder：Spring Security存储当前认证用户信息的核心类，设置后后续请求会自动识别用户已登录。
• HttpSessionSecurityContextRepository：将SecurityContext存入Session，确保会话期间保持登录状态，避免后续请求丢失认证信息。
• 需确保UserDetailsService的loadUserByUsername方法能正确根据注册后的用户信息加载UserDetails对象，否则认证会失败。

内容的提问来源于stack exchange，提问作者Nam Nguyen