在最新的Spring Security教程-Spring Security实现访问控制教程中，如果没有授权的用户访问加密的页面，默认的403页面就会展示
在本次教程中，我们教你两种自定义Spring Security 默认的403页面的方法
1.使用access-denied-handler标签
最简单的方法就是使用access-denied-handler标签，在“error-page”设置你自己的403页面
|
1
2
3
4
|
<http auto-config="true">
<intercept-url pattern="/admin*" access="ROLE_ADMIN" />
<access-denied-handler error-page="404"/>
</http>
|
2.实现AccessDeniedHandler类
第二种方法就是创建一个类并实现AccessDeniedHandler类，重写“handle()”方法，在里面设置你自己的访问逻辑
MyAccessDeniedHandler.java
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
package com.mkyong.common.handler;
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.access.AccessDeniedHandler;
public class MyAccessDeniedHandler implements AccessDeniedHandler {
private String accessDeniedUrl;
public MyAccessDeniedHandler() {
}
public MyAccessDeniedHandler(String accessDeniedUrl) {
this.accessDeniedUrl = accessDeniedUrl;
}
@Override
public void handle(HttpServletRequest request,
HttpServletResponse response,
AccessDeniedException accessDeniedException) throws IOException,
ServletException {
response.sendRedirect(accessDeniedUrl);
request.getSession().setAttribute("message",
"You do not have permission to access this page!");
}
public String getAccessDeniedUrl() {
return accessDeniedUrl;
}
public void setAccessDeniedUrl(String accessDeniedUrl) {
this.accessDeniedUrl = accessDeniedUrl;
}
} |
3.例子
下面假设是你自定义的403页面
403.jsp
|
1
2
3
4
5
6
|
<html>
<body>
<h1>HTTP Status 403 - Access is denied</h1>
<h3>Message : ${message}</h3>
</body>
</html>
|
现在假如没有权限的用户访问受保护的页面，你自定义的403页面就会展示：
原创文章，转载请注明出处：http://www.it161.com/article/javaDetail?articleid=140113232712
更多原创内容，请访问：http://www.it161.com/