Spring Security教程之自定义Spring Security默认的403页面

在最新的Spring Security教程-Spring Security实现访问控制教程中，如果没有授权的用户访问加密的页面，默认的403页面就会展示

在本次教程中，我们教你两种自定义Spring Security 默认的403页面的方法

1.使用access-denied-handler标签

最简单的方法就是使用access-denied-handler标签，在“error-page”设置你自己的403页面

 < http  auto-config = "true" >
    < intercept-url  pattern = "/admin*"  access = "ROLE_ADMIN"  />
    < access-denied-handler  error-page = "404" />
  </ http >

2.实现AccessDeniedHandler类

第二种方法就是创建一个类并实现AccessDeniedHandler类，重写“handle()”方法，在里面设置你自己的访问逻辑

MyAccessDeniedHandler.java 

package  com.mkyong.common.handler;

import  java.io.IOException;
import  javax.servlet.ServletException;
import  javax.servlet.http.HttpServletRequest;
import  javax.servlet.http.HttpServletResponse;
import  org.springframework.security.access.AccessDeniedException;
import  org.springframework.security.web.access.AccessDeniedHandler;

public  class  MyAccessDeniedHandler  implements  AccessDeniedHandler {
    private  String accessDeniedUrl;

    public  MyAccessDeniedHandler() {
    }

    public  MyAccessDeniedHandler(String accessDeniedUrl) {
        this .accessDeniedUrl = accessDeniedUrl;
    }

    @Override
    public  void  handle(HttpServletRequest request,
        HttpServletResponse response,
        AccessDeniedException accessDeniedException)  throws  IOException,
        ServletException {

       response.sendRedirect(accessDeniedUrl);
       request.getSession().setAttribute( "message" ,
        "You do not have permission to access this page!" );

    }

    public  String getAccessDeniedUrl() {
        return  accessDeniedUrl;
    }

    public  void  setAccessDeniedUrl(String accessDeniedUrl) {
        this .accessDeniedUrl = accessDeniedUrl;
    }
}

3.例子

下面假设是你自定义的403页面

403.jsp

< html >
< body >
    < h1 >HTTP Status 403 - Access is denied</ h1 >
    < h3 >Message : ${message}</ h3 >
</ body >
</ html >

现在假如没有权限的用户访问受保护的页面，你自定义的403页面就会展示：

原创文章，转载请注明出处：http://www.it161.com/article/javaDetail?articleid=140113232712

更多原创内容，请访问：http://www.it161.com/