Spring Security教程之自定义Spring Security默认的403页面 - JAVA

在最新的Spring Security教程-Spring Security实现访问控制教程中，如果没有授权的用户访问加密的页面，默认的403页面就会展示

在本次教程中，我们教你两种自定义Spring Security 默认的403页面的方法

1.使用access-denied-handler标签

最简单的方法就是使用access-denied-handler标签，在“error-page”设置你自己的403页面

1 2 3 4 <http auto-config="true"> <intercept-url pattern="/admin*" access="ROLE_ADMIN" /> <access-denied-handler error-page="404"/> http>

2.实现AccessDeniedHandler类

第二种方法就是创建一个类并实现AccessDeniedHandler类，重写“handle()”方法，在里面设置你自己的访问逻辑

MyAccessDeniedHandler.java

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 package com.mkyong.common.handler; import java.io.IOException; import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.springframework.security.access.AccessDeniedException; import org.springframework.security.web.access.AccessDeniedHandler; public class MyAccessDeniedHandler implements AccessDeniedHandler { private String accessDeniedUrl; public MyAccessDeniedHandler() { } public MyAccessDeniedHandler(String accessDeniedUrl) { this.accessDeniedUrl = accessDeniedUrl; } @Override public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException { response.sendRedirect(accessDeniedUrl); request.getSession().setAttribute("message", "You do not have permission to access this page!"); } public String getAccessDeniedUrl() { return accessDeniedUrl; } public void setAccessDeniedUrl(String accessDeniedUrl) { this.accessDeniedUrl = accessDeniedUrl; } }

3.例子

下面假设是你自定义的403页面

403.jsp

1 2 3 4 5 6 html plain"><html> <body> <h1>HTTP Status 403 - Access is denied h1> <h3>Message : ${message} h3> body> html>

现在假如没有权限的用户访问受保护的页面，你自定义的403页面就会展示：

原创文章，转载请注明出处：http://www.it161.com/article/javaDetail articleid=140113232712

更多原创内容，请访问：http://www.it161.com/