弹簧安全自动登录拦截

Question

我已经开发了一个带有Security的注册和登录模块。我现在关心的是如何拦截自动存储的登录以将信息保存在数据库中。我的意思是，当用户标记“记住我”时，如果进入我的应用程序，自动进入登录主页，但我想在数据库中注册访问权限。

现在，当用户显式地浏览登录页面时，很容易做到这一点，但在上述情况下则不然。

致以敬意，

更新：我放了一些额外的信息：

• security.xml
• userServiceImpl @Service @Transactional公共类UserServiceImpl实现UserDetailsService { @Resource私有UserDao userDao；public UserDetails loadUserByUsername(字符串用户名)抛出UsernameNotFoundException { List AUTHORITIES = new ArrayList()；String密码=userDao.getUserPassword(用户名)；if (密码！=null){userDao.registerAccess(用户名)；AUTHORITIES.add(新SimpleGrantedAuthority("ROLE_REGISTERED"))；返回新用户(用户名、密码、权限)；}{引发新的UsernameNotFoundException(“未找到用户：”+用户名)；}} }

Answer 1

你可以做这样的事

@Component
public class AppListener implements ApplicationListener {


    @Override
    public void onApplicationEvent(ApplicationEvent event) {
        if (event instanceof InteractiveAuthenticationSuccessEvent) {
            handleLoginEvent();
        } else if (event instanceof HttpSessionDestroyedEvent)
            handleLogoutEvent((HttpSessionDestroyedEvent) event);

    }

    private void handleLoginEvent() {
      // handle login event
    }

    private synchronized void handleLogoutEvent(HttpSessionDestroyedEvent event) {
        // handle logout event
    }

}

致以敬意，

EDIT

将此添加到web.xml中

  <listener>
         <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
  </listener>

Answer 2

您在这里有多个选项：

• 设置您的org.springframework.security.web.authentication.AuthenticationSuccessHandler
• 订阅org.springframework.security.authentication.event.InteractiveAuthenticationSuccessEvent (见@Ionut答案)

AuthenticationSuccessHandler将同样适用于两种情况下的，(正常登录并记住我)：

public class CustomAuthenticationSuccessHandler extends SavedRequestAwareAuthenticationSuccessHandler {

    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
    Authentication authentication) throws ServletException, IOException {
        // log authentication success here for both cases
        super.onAuthenticationSuccess(request, response, authentication);
    }

}

在你的security.xml里

<bean id="customAuthenticationSuccessHandler" class="com.domain.security.CustomAuthenticationSuccessHandler"/>


<security:http ... >
    ...
    <security:form-login login-page='/login.html' authentication-success-handler-ref="customAuthenticationSuccessHandler" />
    <security:remember-me authentication-success-handler-ref="customAuthenticationSuccessHandler" />

</security:http>