【Web前端问题】spring security 前端登录后,请求后台api报302

Z时代
2024-01-10
分类：技术分享

问题描述

我在spring boot项目中引入有了security" title="spring security">spring security来做登录验证这样的事情.因为是前后端分离的项目,所以,我的前端有个这样的登录请求

        function login(){
            $.ajax({
                useDefaultXhrHeader: false,
                type:"post",
                url:"http://127.0.0.1:8080/user/login",
                data:{"userName": document.getElementById("userName").value,
                    "password":document.getElementById("password").value},
                dataType:'json',
                success:function (result) {
                    console.log(result);
                    if(result["code"] == 0) {
                        showVideoByAll();
                        setCookie("username",result["username"],1);
                        alert("login success");
                 //       location.href = "./index.html";
                    } else {
                        alert("invalid password or userName")
                    }
                },
                error:function () {
                    alert("error")
                }
            });        }

在登录后,我使用ajax调后台的接口

    function showVideoByAll(){/**/
            $.ajax({
                useDefaultXhrHeader: false,
                type:"GET",
                url:"http://127.0.0.1:8080/video/selectVideoByAll",
                data:"",
                dataType:'json',
                success:function (result) {
                    alert("success")
                   console.log(result);
                },
                error:function () {
                  alert("error");
                }
            });        }

这是后台的security配置

 @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity
                .formLogin()
                .loginProcessingUrl("/user/login")
                .usernameParameter("userName")
                .passwordParameter("password")
                .successHandler(myAuthenticationSuccessHandler)
                .failureHandler(myAuthenticationFailureHandler)
                .and()
                .authorizeRequests()
                .antMatchers("/user/register","/user/login",
                        "/swagger-ui.html",
                        "/swagger-resources/**",
                        "/webjars/**",
                        "/v2/api-docs",
                        "Swagger2Config").permitAll()
                .anyRequest().authenticated()
                .and()
                .logout()
                .logoutUrl("/user/logout")
                .logoutSuccessHandler(myLogoutSuccessHandler)
                .permitAll()
                .and()
                .cors().and()
                .csrf().disable();
    }

可以看到我配置了

  .csrf().disable();

这是后台controller的部分代码

@RestController
@CrossOrigin
@RequestMapping("/video")
public class VideoController {
    @Autowired
    private VideoDAO videoDAO;
    /**
     * @return
     */
    @RequestMapping(value = {"/selectVideoByAll"}, method = RequestMethod.GET)
    public ResultModel selectVideoByAll() {
        try {
            List<Video> videoList = videoDAO.selectVideoByAll();
            Map<String, Object> map = new HashMap<String, Object>();
            map.put("content", videoList);
            return ResultUtil.result(0, "", map);
        } catch (Exception e) {
            return ResultUtil.result(404, e.getMessage(), null);
        }
    }    ...