Springsecurity的权限提示页面

springsecurity的权限提示页面

最近项目中发现，用户在访问没有权限的页面的时候，系统返回了白页，后台也有日志报出如下：
12-13 17:34:33 [DEBUG] org.springframework.security.ui.ExceptionTranslationFilter.handleException(ExceptionTranslationFilter.java:167) - Access is denied (user is not anonymous); delegating to AccessDeniedHandler
org.springframework.security.AccessDeniedException: Access is denied
at org.springframework.security.vote.AffirmativeBased.decide(AffirmativeBased.java:68)
at org.springframework.security.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:262)
at org.springframework.security.intercept.web.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:106)
at org.springframework.security.intercept.web.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:83)
at org.springframework.security.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:390)
at org.springframework.security.ui.ExceptionTranslationFilter.doFilterHttp(ExceptionTranslationFilter.java:101)
at org.springframework.security.ui.SpringSecurityFilter.doFilter(SpringSecurityFilter.java:53)
at org.springframework.security.util.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:390)
at org.springframework.security.providers.anonymous.AnonymousProcessingFilter.doFilterHttp(AnonymousProcessingFilter.java:105)

看到很多BLOG都有记录如何配置这个权限的提示页面，比较全面的配置如下：
<beans:bean id="exceptionTranslationFilter"
class="org.springframework.security.ui.ExceptionTranslationFilter">
<beans:property name="accessDeniedHandler" ref="accessDeniedHandler" />
<beans:property name="authenticationEntryPoint" ref="authenticationEntryPoint"/>
</beans:bean>
<!-- 处理org.springframework.security.AccessDeniedException -->
<beans:bean id="accessDeniedHandler"
class="org.springframework.security.ui.AccessDeniedHandlerImpl">
<beans:property name="errorPage" value="/common/403.jsp" />
</beans:bean>
<!-- 处理org.springframework.security.AuthenticationException -->
<beans:bean id="authenticationEntryPoint"
class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint" >
<beans:property name="loginFormUrl" value="/user/login.do" />
<beans:property name="forceHttps" value="false" />
</beans:bean>
但却发现，我这样配置了，但是系统调用的，并没有按照我配置来走。原来是这里我采用了springsecurity2的一个配置：
<http auto-config="true" lowercase-comparisons="false"
session-fixation-protection="none" access-denied-page="/common/403.jsp">
里面的这个auto-config=true，就默认帮你把exceptionTranslationFilter给配置了，所以后面加也没有用了。
仔细一看，嘿嘿，后面不是有个参数，access-denied-page么，修改，晕。果然生效。看来以后要加配置之前，先看看这个<http>的文档先。貌似以前在ITSM项目遇到这个问题了，我就查看了文档并做了修改的，只是当时没有记录日志，久了就忘记了。唉，今天下午又调试了几个小时才发现。唉。印象深刻了吧，以后小心。