jsessionid가없는 리소스에 액세스가 거부되는 이유는 무엇입니까?

Question

나는 내 로컬 환경에서 잘 작동하는 앱을 만들었습니다. 그러나 인증을 위해 Siteminder를 사용하는 개발 환경에 배포 할 때 모든 이미지와 CSS 파일에 대해 "액세스 거부"가 발생합니다. 나는 인증 후에 jsessionid가 url에 추가 된 것을 알아 차 렸습니다. 수동으로 테스트하여 jsessionid를 이미지 url에 붙여 넣습니다. 이제 이미지가 나타납니다!

누구나 무슨 일이 벌어 질지 상상해보십시오. jsessionid가 이미지 및 CSS에 액세스하는 데 중요한 이유는 무엇입니까?

난 그 도움이된다면 어떤 코드 예제를 게시 기쁠 것

...

** 편집

나는 몇 가지 추가 로깅을 설정했는데 문제가 어디 있는지 볼 수 있지만, 정말 그것을 해결하는 방법.

19:40:27,236 INFO [STDOUT] 2010-12-17 19:40:27,236 [http-0.0.0.0-30080-1] DEBUG org.springframework.security.web.access.ExceptionTranslationFilter - Authentication exception occurred; redirecting to authentication entry point 
org.springframework.security.web.authentication.preauth.PreAuthenticatedCredentialsNotFoundException: SM_USER header not found in request. 
    at org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter.getPreAuthenticatedPrincipal(RequestHeaderAuthenticationFilter.java:43) 
    at org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter.doAuthenticate(AbstractPreAuthenticatedProcessingFilter.java:98) 
    at org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter.doFilter(AbstractPreAuthenticatedProcessingFilter.java:86) 
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:355) 
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:97) 
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:355) 
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:79) 
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:355) 
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:149) 
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:237) 
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:167) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) 
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:88) 
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) 
    at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206) 
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:230) 
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175) 
    at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:179) 
    at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:84) 
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:128) 
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:104) 
    at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157) 
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109) 
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:241) 
    at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844) 
    at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:580) 
    at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447) 
    at java.lang.Thread.run(Thread.java:619) 

내 봄 보안 설정 :

<beans xmlns="http://www.springframework.org/schema/beans" 
    xmlns:security="http://www.springframework.org/schema/security" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd 
       http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.3.xsd"> 

    <bean id="filterSecurityInterceptor" 
     class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor"> 
     <property name="authenticationManager" ref="authenticationManager" /> 
     <property name="accessDecisionManager" ref="accessDecisionManager" /> 
     <property name="securityMetadataSource"> 
      <security:filter-security-metadata-source> 
       <security:intercept-url pattern="/" 
        access="ROLE_VIEW_WELCOME" /> 
       <security:intercept-url pattern="/cfs" 
        access="ROLE_VIEW_WELCOME" /> 
       <security:intercept-url pattern="/app" 
        access="ROLE_VIEW_WELCOME" /> 
       <security:intercept-url pattern="/welcome/**" 
        access="ROLE_VIEW_WELCOME" /> 
       <security:intercept-url pattern="/styles/**" 
        access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
       <security:intercept-url pattern="/scripts/**" 
        access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
       <security:intercept-url pattern="/images/**" 
        access="IS_AUTHENTICATED_ANONYMOUSLY" /> 
       <security:intercept-url pattern="/ruleManagement/**" 
        access="ROLE_VIEW_RULE_MANAGEMENT" /> 
       <security:intercept-url pattern="/vendorManagement/**" 
        access="ROLE_VENDOR_MANAGEMENT" /> 
       <security:intercept-url pattern="/userManagement/**" 
        access="ROLE_USER_MANAGEMENT" /> 
       <security:intercept-url pattern="/titleManagement/**" 
        access="ROLE_TITLE_MANAGEMENT" /> 
       <security:intercept-url pattern="/typeManagement/**" 
        access="ROLE_TYPE_MANAGEMENT" /> 
       <security:intercept-url pattern="/seriesManagement/**" 
        access="ROLE_SERIES_MANAGEMENT" /> 
       <security:intercept-url pattern="/sequenceManagement/**" 
        access="ROLE_SEQUENCE_MANAGEMENT" /> 
       <security:intercept-url pattern="/roleManagement/**" 
        access="ROLE_GROUP_MANAGEMENT" />     
       <security:intercept-url pattern="/reports/**" 
        access="ROLE_REPORTS" />          
       <security:intercept-url pattern="/reportsNew/**" 
        access="ROLE_REPORTS" />           
       <security:intercept-url pattern="/fingerprint/**" 
        access="ROLE_FINGERPRINT" /> 
       <security:intercept-url pattern="/**" 
        access="ROLE_VIEW_OTHER" /> 
      </security:filter-security-metadata-source> 
     </property> 
    </bean> 

    <bean id="exceptionTranslationFilter" 
     class="org.springframework.security.web.access.ExceptionTranslationFilter"> 
     <property name="authenticationEntryPoint" ref="preauthenticationProcessingFilterEntryPoint" /> 
     <property name="accessDeniedHandler" ref="accessDeniedHandler" /> 
    </bean> 

    <security:authentication-manager alias="authenticationManagerParent" /> 

    <bean id="authenticationManager" 
     class="org.springframework.security.authentication.ProviderManager" 
     parent="authenticationManagerParent"> 
     <property name="providers"> 
      <list> 
       <ref local="preauthAuthProvider" /> 
      </list> 
     </property> 
    </bean> 

    <bean id="accessDecisionManager" 
     class="org.springframework.security.access.vote.AffirmativeBased"> 
     <property name="allowIfAllAbstainDecisions" value="false" /> 
     <property name="decisionVoters"> 
      <list> 
       <bean class="org.springframework.security.access.vote.RoleVoter" /> 
       <bean class="org.springframework.security.access.vote.AuthenticatedVoter" /> 
      </list> 
     </property> 
    </bean> 

    <bean id="sessionRegistry" class="org.acegisecurity.concurrent.SessionRegistryImpl" /> 

    <bean id="defaultConcurrentSessionController" 
     class="org.acegisecurity.concurrent.ConcurrentSessionControllerImpl"> 
     <property name="sessionRegistry" ref="sessionRegistry" /> 
     <property name="exceptionIfMaximumExceeded" value="true" /> 
    </bean> 

    <bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy"> 
     <security:filter-chain-map path-type="ant"> 
      <security:filter-chain pattern="/**" 
       filters="securityContextPersistenceFilter, exceptionTranslationFilter, siteminderFilter, filterSecurityInterceptor" /> 
     </security:filter-chain-map> 
    </bean> 

    <bean id="securityContextPersistenceFilter" 
     class="org.springframework.security.web.context.SecurityContextPersistenceFilter"> 
     <property name='securityContextRepository'> 
      <bean 
       class='org.springframework.security.web.context.HttpSessionSecurityContextRepository'> 
       <property name='allowSessionCreation' value='true' /> 
      </bean> 
     </property> 
    </bean> 

    <bean id="siteminderFilter" 
     class="org.springframework.security.web.authentication.preauth.RequestHeaderAuthenticationFilter"> 
     <property name="principalRequestHeader" value="SM_USER" /> 
     <property name="authenticationManager" ref="authenticationManager" /> 
     <property name="continueFilterChainOnUnsuccessfulAuthentication" 
      value="false" /> 
    </bean> 

    <bean id="mockSiteMinderFilter" class="com.disney.cfs.util.SiteMinderMockFilter"/> 

    <bean id="preauthAuthProvider" 
     class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"> 
     <property name="preAuthenticatedUserDetailsService" ref="userDetailsService"/> 
    </bean> 

    <bean id="userDetailsService" class="com.disney.cfs.util.UserDetailsServiceUtil"/> 

    <bean id="preauthenticationProcessingFilterEntryPoint" 
     class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint" /> 

    <bean id="accessDeniedHandler" 
     class="org.springframework.security.web.access.AccessDeniedHandlerImpl"> 
     <property name="errorPage" value="/accessDenied.jsp" /> 
    </bean> 
</beans> 

Answer 1

브라우저 설정을 확인합니다. 쿠키가 사용 중지 된 것 같습니다. 이 경우 세션을 식별하는 유일한 방법은 URL 매개 변수를 통해 세션을 전달하는 것입니다.

다른 가능성은 인증 패키지 (Siteminder)의 구성입니다. 개인적으로는 모르지만 매개 변수를 통해 세션 ID를 전달해야한다고 추측하고 쿠키에서 가져 오는 값과 비교합니다. 이것은 해커의 삶을 매우 어렵게 만드는 매우 안전한 응용 프로그램을 만드는 방법입니다. 그래서 아마도 더 나은 해결책은 각 URL에 jsessionid를 추가하는 것입니다. 사용자 정의 태그 라이브러리를 사용하는 경우 쉽게 수행 할 수 있습니다. 이 경우 href의 각 값에 jsessionid를 추가하는 자체 태그 "a"를 구현할 수 있습니다.