如何使用 Spring security OpenID 进行身份验证时携带字符串值
我已经为此工作好几天了，希望有人能帮助我。
认证处理有三个要求。
- 使用OpenID进行身份验证，登录页面是login.jsp。登录成功后，在login-succ.jsp中显示用户名和电子邮件地址
- login.jsp中有一个输入字段，如果登录成功，我还需要在login-succ.jsp中显示mymessage的值
- 登录成功后，用户位于login-succ.jsp 中，其中包含他的用户名电子邮件地址和mymessage 值。如果用户刷新login-succ.jsp页面，这三个值应该再次显示。
我尝试在另一个 post，但是如果我将消息保存到会话中并且有两个 login.jsp 实例，则这两个实例将在刷新操作后相互覆盖消息值。我不知道我是否做错了一切。那么有人可以给我一些关于如何使用 Spring security 和 Spring MVC 满足这三个要求的建议吗？
谢谢。
I have been working on this for several days, and hope someone can help me.
There are three requirements for the authentication processing.
- Authentication using OpenID, login page is login.jsp. After login is successfully, display the username and email address at login-succ.jsp
- There is a input field in the login.jsp, I also need to display the value of mymessage in the login-succ.jsp if login is successfully
- After login successfully, user is in the login-succ.jsp, with his username email address and mymessage value. If user refresh the login-succ.jsp page, these three values should be display again.
I have tried to achieve these three requirements using CustomOpenIDAuthenticationFilter at my another post, but if I save the message into session and there are two instances of login.jsp, the two instances will overwrite the message values to each other after refresh action. I do not know if I am doing everything wrong. So can anyone please give me some suggestions about how to meet these three requirements using Spring security and Spring MVC.
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
对我来说，这感觉就像是一个乞求某种类型的注入攻击的设计（在页面上盲目地向用户显示 URL 参数是一个非常的坏主意）。
相反，我会在用户重定向到 OpenID 登录之前将消息粘贴到 HttpSession 中，并在成功重定向后检索消息。显然，您需要代码来在失败、注销等情况下清除会话中的消息。
To me, this feels like a design that is begging for some type of injection attack (taking a URL parameter that is displayed blindly on the page to the user is a really bad idea).
Instead, I would stick the message in the
HttpSessionprior to the user being redirected to OpenID login, and retrieve the message after they are successfully redirected. Obviously, you would need code to clear the message from the session upon failure, logout, etc.