HTTPS安全保护只能在主页上工作，不能在下一页上工作

Question

我在AWS EC2实例的80端口上部署了一个spring boot When应用程序，当我点击像用户登录或管理员登录这样的链接时，主页显示为安全，浏览器显示它不是Secured.What，我应该这样做才能保护我的整个应用程序。

下面是我的代码，我正在使用的一个网站，我是新手spring安全，请帮助。

Home.html

<div class="starter-template">
                <h1>Spring Boot Web Thymeleaf + Spring Security</h1>
                <h2>1. Visit <a th:href="@{/admin}">Admin page (Spring Security protected, Need Admin Role)</a></h2>
                <h2>2. Visit <a th:href="@{/user}">User page (Spring Security protected, Need User Role)</a></h2>
                <h2>3. Visit <a th:href="@{/about}">Normal page</a></h2>
            </div>


    @Configuration
    // http://docs.spring.io/spring-boot/docs/current/reference/html/howto-security.html
    // Switch off the Spring Boot security configuration
    //@EnableWebSecurity
    public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {

        @Autowired
        private AccessDeniedHandler accessDeniedHandler;

        // roles admin allow to access /admin/**
        // roles user allow to access /user/**
        // custom 403 access denied handler
        @Override
        protected void configure(HttpSecurity http) throws Exception {

            http.csrf().disable()
                    .authorizeRequests()
                    .antMatchers("/", "/home", "/about").permitAll()
                    .antMatchers("/admin/**").hasAnyRole("ADMIN")
                    .antMatchers("/user/**").hasAnyRole("USER")
                    .anyRequest().authenticated()
                    .and()
                    .formLogin()
                    .loginPage("/login")
                    .permitAll()
                    .and()
                    .logout()
                    .permitAll()
                    .and()
                    .exceptionHandling().accessDeniedHandler(accessDeniedHandler);
        }


            @Autowired
            public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {

                auth.inMemoryAuthentication()
                        .withUser("user").password("password").roles("USER")
                        .and()
                        .withUser("admin").password("password").roles("ADMIN");
            }
        }

我做错了什么?问题出在代码还是我的AWS配置中

Answer 1

通过将application.properties设置为以下值解决了此问题

server.use-forward-headers=true