升级Spring Security 5.3.3.RELEASE后security_check_form页面找不到

问题描述 #

将Spring Security版本升级至5.3.3.RELEASE后，WAR包可正常构建部署，但登录页面提交凭据时，出现/security_check_form页面找不到的错误。已尝试将配置中的<property>替换为<beans:property>，问题仍未解决。

核心配置片段 #

<security:http use-expressions="true" entry-point-ref="AuthenticationEntryPoint" disable-url-rewriting="true">
    <security:intercept-url pattern="/testing.jsp*" access="isAuthenticated()" />
    <security:custom-filter position="CONCURRENT_SESSION_FILTER" ref="normalConcurrentSessionFilter"/>
    <security:custom-filter position="FORM_LOGIN_FILTER" ref="ogaLoginFilter"/>
    <security:intercept-url pattern="/testing/gwt-log" access="permitAll"/>
    <security:intercept-url pattern="/images*"  access="permitAll"/>
    <security:intercept-url pattern="/css*" access="permitAll"/>
    <security:intercept-url pattern="/login"    access="permitAll"/>
    <security:intercept-url pattern="/signin" access="permitAll"/>
    <security:intercept-url pattern="/forgotPassword" access="permitAll"/>
    <security:intercept-url pattern="/singlesignin" access="permitAll"/> 
    <security:session-management session-authentication-strategy-ref="sessionAuthenticationStrategy"/>
    <security:logout invalidate-session="true"
        success-handler-ref="normalLogoutSucessHandler" logout-url="logout"
        delete-cookies="JSESSIONID" />
</security:http>

<bean id="ogaLoginFilter"
    class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
    <property name="sessionAuthenticationStrategy" ref="sessionAuthenticationStrategy" />
    <property name="authenticationManager" ref="AuthenticationManager" />
    <property name="authenticationSuccessHandler" ref="AuthenticationSuccessHandler"/>
    <property name="authenticationFailureHandler" ref="AuthenticationFailureHandler"/>
    <property name="filterProcessesUrl" value="/security_check_form"></property>  
</bean>

排查与解决方案 #

1. 添加/security_check_form的权限放行规则 #

Spring Security会拦截所有未明确放行的请求，当前配置中没有为/security_check_form添加permitAll的拦截规则，导致请求被拦截后返回404。在<security:http>块中添加：

<security:intercept-url pattern="/security_check_form" access="permitAll"/>

2. 验证登录表单的action路径是否匹配 #

确保登录表单的action属性值与filterProcessesUrl完全一致，包括应用上下文路径（如果部署在非根路径下）。示例代码：

<form action="${pageContext.request.contextPath}/security_check_form" method="post">
    <!-- 用户名、密码输入框及提交按钮 -->
</form>

3. 确认过滤器注册的有效性 #

检查自定义的ogaLoginFilter是否正确绑定到FORM_LOGIN_FILTER位置：

• 避免重复注册其他UsernamePasswordAuthenticationFilter实例
• 验证sessionAuthenticationStrategy、AuthenticationManager等依赖bean是否正常初始化

4. 排查其他拦截器干扰 #

检查是否存在Spring MVC拦截器或第三方Web过滤器，拦截了/security_check_form请求导致无法到达Spring Security过滤器链。可开启Spring Security的DEBUG级别日志，追踪请求的完整处理流程。

内容的提问来源于stack exchange，提问作者Christopher Chua