Эхлэл Бүгдийг харах Тусламж
Бүртгүүлэх Нэвтрэх
github
/
spring-security
-ын хуулбар https://github.com/spring-projects/spring-security
2
0
Салаа 0
Файлууд Асуудлууд 0 Мэдлэгийн сан
Эх сурвалжийг харах

SEC-3068: Update Tutorial to use POST /logout

Rob Winch 10 жил өмнө
parent
8cc9108601
commit
b0701ea770
4 өөрчлөгдсөн 56 нэмэгдсэн , 43 устгасан
Өөрчлөллтийг нэгтгэж харах Өөрчлөлтийн статистик харах
  1. 8 8
      samples/tutorial-xml/src/main/webapp/WEB-INF/applicationContext-security.xml
  2. 23 18
      samples/tutorial-xml/src/main/webapp/WEB-INF/jsp/listAccounts.jsp
  3. 14 10
      samples/tutorial-xml/src/main/webapp/secure/extreme/index.jsp
  4. 11 7
      samples/tutorial-xml/src/main/webapp/secure/index.jsp

+ 8 - 8
samples/tutorial-xml/src/main/webapp/WEB-INF/applicationContext-security.xml
Файл харах 

@@ -1,9 +1,9 @@
 
 <?xml version="1.0" encoding="UTF-8"?>
 
 <?xml version="1.0" encoding="UTF-8"?>
 
 
 
 <!--
 
 <!--
 
-  - Sample namespace-based configuration
 
-  -
 
-  -->
 
+- Sample namespace-based configuration
 
+-
 
+-->
 
 
 
 <beans:beans xmlns="http://www.springframework.org/schema/security"
 
 <beans:beans xmlns="http://www.springframework.org/schema/security"
 
 	xmlns:beans="http://www.springframework.org/schema/beans"
 
 	xmlns:beans="http://www.springframework.org/schema/beans"
 
@@ -19,12 +19,12 @@
 
 	<http pattern="/loggedout.jsp" security="none"/>
 
 	<http pattern="/loggedout.jsp" security="none"/>
 
 
 
 	<http>
 
 	<http>
 
-		<intercept-url pattern="/secure/extreme/**" access="hasRole('supervisor')"/>
 
-		<intercept-url pattern="/secure/**" access="isAuthenticated()" />
 
+		<intercept-url pattern="/secure/extreme/**" access="hasAuthority('supervisor')"/>
 
+		<intercept-url pattern="/secure/**" access="authenticated" />
 
 		<!--
 
 		<!--
 
-			 Allow all other requests. In a real application you should
 
-			 adopt a whitelisting approach where access is not allowed by default
 
-		  -->
 
+			Allow all other requests. In a real application you should
 
+			adopt a whitelisting approach where access is not allowed by default
 
+		-->
 
 		<intercept-url pattern="/**" access="permitAll" />
 
 		<intercept-url pattern="/**" access="permitAll" />
 
 		<form-login />
 
 		<form-login />
 
 		<logout logout-success-url="/loggedout.jsp" delete-cookies="JSESSIONID"/>
 
 		<logout logout-success-url="/loggedout.jsp" delete-cookies="JSESSIONID"/>

+ 23 - 18
samples/tutorial-xml/src/main/webapp/WEB-INF/jsp/listAccounts.jsp
Файл харах 

@@ -1,13 +1,14 @@
 
 <%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
 
 <%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
 
+<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
 
 
 
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 
 
 
 <html>
 
 <html>
 
-  <head>
 
-      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
 
-      <link rel="stylesheet" href="<c:url value='/static/css/tutorial.css'/>" type="text/css" />
 
-      <title>Accounts</title>
 
-  </head>
 
+<head>
 
+	<meta http-equiv="content-type" content="text/html; charset=UTF-8">
 
+	<link rel="stylesheet" href="<c:url value='/static/css/tutorial.css'/>" type="text/css" />
 
+	<title>Accounts</title>
 
+</head>
 
 <body>
 
 <body>
 
 <div id="content">
 
 <div id="content">
 
 
 
@@ -32,22 +33,26 @@ Anyone can view this page, but posting to an Account requires login and must be
 
 <td><b>Operations</b></td>
 
 <td><b>Operations</b></td>
 
 </tr>
 
 </tr>
 
 <c:forEach var="account" items="${accounts}">
 
 <c:forEach var="account" items="${accounts}">
 
-  <tr>
 
-  <td>${account.id}</td>
 
-  <td>${account.holder}</td>
 
-  <td>${account.balance}</td>
 
-  <td>${account.overdraft}</td>
 
-  <td>
 
-      <a href="post.html?id=${account.id}&amp;amount=-20.00">-$20</a>
 
-      <a href="post.html?id=${account.id}&amp;amount=-5.00">-$5</a>
 
-      <a href="post.html?id=${account.id}&amp;amount=5.00">+$5</a>
 
-      <a href="post.html?id=${account.id}&amp;amount=20.00">+$20</a>
 
-  </td>
 
-  </tr>
 
+<tr>
 
+<td>${account.id}</td>
 
+<td>${account.holder}</td>
 
+<td>${account.balance}</td>
 
+<td>${account.overdraft}</td>
 
+<td>
 
+	<a href="post.html?id=${account.id}&amp;amount=-20.00">-$20</a>
 
+	<a href="post.html?id=${account.id}&amp;amount=-5.00">-$5</a>
 
+	<a href="post.html?id=${account.id}&amp;amount=5.00">+$5</a>
 
+	<a href="post.html?id=${account.id}&amp;amount=20.00">+$20</a>
 
+</td>
 
+</tr>
 
 </c:forEach>
 
 </c:forEach>
 
 </table>
 
 </table>
 
 
 
-<p><a href="logout">Logout</a></p>
 
+<p>
 
+<form action="logout" method="post">
 
+	<sec:csrfInput />
 
+	<input type="submit" value="Logout"/>
 
+</form>
 
 </div>
 
 </div>
 
 </body>
 
 </body>
 
 </html>
 
 </html>

+ 14 - 10
samples/tutorial-xml/src/main/webapp/secure/extreme/index.jsp
Файл харах 

@@ -1,25 +1,29 @@
 
-<%@ taglib prefix="authz" uri="http://www.springframework.org/security/tags" %>
 
+<%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
 
 <%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
 
 <%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
 
 
 
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 
 
 
 <html>
 
 <html>
 
-  <head>
 
-      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
 
-      <link rel="stylesheet" href="<c:url value='/static/css/tutorial.css'/>" type="text/css" />
 
-      <title>Secure Page</title>
 
-  </head>
 
+<head>
 
+	<meta http-equiv="content-type" content="text/html; charset=UTF-8">
 
+	<link rel="stylesheet" href="<c:url value='/static/css/tutorial.css'/>" type="text/css" />
 
+	<title>Secure Page</title>
 
+</head>
 
 <body>
 
 <body>
 
 <div id="content">
 
 <div id="content">
 
 <h1>VERY Secure Page</h1>
 
 <h1>VERY Secure Page</h1>
 
 This is a protected page. You can only see me if you are a supervisor.
 
 This is a protected page. You can only see me if you are a supervisor.
 
 
 
-<authz:authorize access="hasRole('supervisor')">
 
-   You have authority "supervisor" (this text is surrounded by &lt;authz:authorize&gt; tags).
 
-</authz:authorize>
 
+<sec:authorize access="hasAuthority('supervisor')">
 
+You have authority "supervisor" (this text is surrounded by &lt;sec:authorize&gt; tags).
 
+</sec:authorize>
 
 
 
 <p><a href="../../">Home</a></p>
 
 <p><a href="../../">Home</a></p>
 
-<p><a href="../../logout">Logout</a></p>
 
+
 
+<form action="../../logout" method="post">
 
+	<sec:csrfInput />
 
+	<input type="submit" value="Logout"/>
 
+</form>
 
 </div>
 
 </div>
 
 </body>
 
 </body>
 
 </html>
 
 </html>

+ 11 - 7
samples/tutorial-xml/src/main/webapp/secure/index.jsp
Файл харах 

@@ -4,11 +4,11 @@
 
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
 
 
 
 <html>
 
 <html>
 
-  <head>
 
-      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
 
-      <link rel="stylesheet" href="<c:url value='/static/css/tutorial.css'/>" type="text/css" />
 
-      <title>Secure Page</title>
 
-  </head>
 
+<head>
 
+	<meta http-equiv="content-type" content="text/html; charset=UTF-8">
 
+	<link rel="stylesheet" href="<c:url value='/static/css/tutorial.css'/>" type="text/css" />
 
+	<title>Secure Page</title>
 
+</head>
 
 <body>
 
 <body>
 
 <div id="content">
 
 <div id="content">
 
 
 
@@ -19,7 +19,7 @@ or if you've authenticated this session.
 
 </p>
 
 </p>
 
 <p>
 
 <p>
 
 <sec:authorize access="hasRole('supervisor')">
 
 <sec:authorize access="hasRole('supervisor')">
 
-    You are a supervisor! You can therefore see the <a href="extreme/index.jsp">extremely secure page</a>.<br/><br/>
 
+	You are a supervisor! You can therefore see the <a href="extreme/index.jsp">extremely secure page</a>.<br/><br/>
 
 </sec:authorize>
 
 </sec:authorize>
 
 </p>
 
 </p>
 
 <h3>Properties obtained using &lt;sec:authentication /&gt; tag</h3>
 
 <h3>Properties obtained using &lt;sec:authentication /&gt; tag</h3>
 
@@ -43,7 +43,11 @@ or if you've authenticated this session.
 
 
 
 
 
 <p><a href="../">Home</a></p>
 
 <p><a href="../">Home</a></p>
 
-<p><a href="../logout">Logout</a></p>
 
+
 
+<form action="../logout" method="post">
 
+	<sec:csrfInput />
 
+	<input type="submit" value="Logout"/>
 
+</form>
 
 </div>
 
 </div>
 
 </body>
 
 </body>
 
 </html>
 
 </html>