403 errori dopo l'aggiornamento a Spring Security 4.0.0

Question

Ho cercato di aggiornare il mio progetto a Spring Security 4.0.0. Penso di aver letto lo migration guide in modo piuttosto estensivo, ma anche se riesco ad accedere e navigare correttamente tra le pagine, ottengo 403 errori su ogni richieste Ajax. Tutto funziona perfettamente con 3.2.7.

Questo è il mio file "manuale di login" Configurazione:

<b:beans xmlns:b="http://www.springframework.org/schema/beans" 
    xmlns="http://www.springframework.org/schema/security" 
    xmlns:p="http://www.springframework.org/schema/p" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:context="http://www.springframework.org/schema/context" 
    xmlns:util="http://www.springframework.org/schema/util" 
    xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd 
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd 
    http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd 
    http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd"> 

    <!-- HTTP security configurations --> 
    <http use-expressions="true" auto-config='true' disable-url-rewriting="false"> 
     <intercept-url access="permitAll" pattern="/" /><!-- To permit "/" allows the use of web.xml's <welcome-file> --> 
     <intercept-url access="permitAll" pattern="/home" /> 
     <intercept-url access="permitAll" pattern="/login" /> 
     <intercept-url access="permitAll" pattern="/pages/exceptions/**" /> 
     <intercept-url access="permitAll" pattern="/javax.faces.resource/**" /> 
     <intercept-url access="permitAll" pattern="/resources/**" /> 
     <intercept-url access="permitAll" pattern="/j_spring_security_check"/> 
     <intercept-url access="hasRole('ROLE_ADMIN')" pattern="/administration/**" /> 
     <intercept-url access="isAuthenticated()" pattern="/**" /> 
     <logout logout-url="/logout" logout-success-url='/home' /> 
     <form-login login-page='/login' 
      username-parameter="j_username" 
      password-parameter="j_password" 
      login-processing-url="/j_spring_security_check" 
      authentication-failure-url="/login?auth=fail" 
      default-target-url="/home" /> 
    </http> 

    <!-- Configure Authentication mechanism --> 
    <authentication-manager alias="authenticationManager"> 
     <authentication-provider ref="${authentication.provider}" /> 
    </authentication-manager> 

    <b:bean name="bcryptEncoder" 
     class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" /> 

    <b:bean id="daoAuthProvider" 
     class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"> 
     <b:property name="userDetailsService"> 
      <b:bean class="eu.ueb.acem.services.auth.DaoUserDetailsService"> 
       <b:property name="domainService" ref="domainService" /> 
      </b:bean> 
     </b:property> 
     <b:property name="passwordEncoder" ref="bcryptEncoder" /> 
    </b:bean> 

</b:beans> 

cerco di usare:

<http use-expressions="true" auto-config='true' disable-url-rewriting="false"> 
    <headers disabled="true" /> 
    <csrf disabled="true"/> 
    ... 
</http> 

ma ottengo:

cvc-complex-type.3.2.2: Attribute 'disabled' is not allowed to appear in element 'headers' 
cvc-complex-type.3.2.2: Attribute 'disabled' is not allowed to appear in element 'csrf' 

che è normale, perché 4.0. 0 non ha uno schema XML dedicato a:

http://www.springframework.org/schema/security/

Quindi cosa potrebbe causare questi errori "403 vietati"?

Answer 1

Ok, ho trovato la soluzione. E 'infatti da usare:

<http use-expressions="true" auto-config='true' disable-url-rewriting="false"> 
    <csrf disabled="true"/> 
    ... 
</http> 

ma per il momento, dobbiamo ignorare l'errore XML Schema in Eclipse. Speriamo che la primavera metterà presto online il loro nuovo Schema.