java – Spring安全登录和注销

我想使用spring security创建一个Web应用程序,但我觉得有些不对劲或缺失. 这是我的代码： security.xml文件： <beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd"> <http use-expressions="true" disable-url-rewriting="true"> <intercept-url pattern="/index.htm" access="hasRole('ROLE_ADMIN')" /> <form-login login-processing-url="/login" login-page="/login.htm" username-parameter="userName" password-parameter="password" default-target-url="/index.htm" always-use-default-target="true" authentication-failure-url="/login.htm?auth=fail" /> <logout logout-url="/logout.htm" logout-success-url="/login?out=1" delete-cookies="JSESSIONID" invalidate-session="true" /> </http> <authentication-manager> <authentication-provider> <user-service> <user name="drs" password="123456" authorities="ROLE_ADMIN" /> <user name="dr" password="123456" authorities="ROLE_USER" /> </user-service> </authentication-provider> </authentication-manager> </beans:beans> 控制器： @Controller public class SecurityController { @RequestMapping(value = "/logout.htm", method = RequestMethod.GET) public String logoutPage() { return "logoutPage"; } @RequestMapping(value = "/login.htm", method = RequestMethod.GET) public String login() { return "loginPage"; } } login.jsp的： <form:form action="${pageContext.request.contextPath}/login" method="POST"> <c:if test="${not empty param.err}"> <div> <c:out value="${SPRING_SECURITY_LAST_EXCEPTION.message}" /> </div> </c:if> <c:if test="${not empty param.out}"> <div>You've logged out successfully.</div> </c:if> <c:if test="${not empty param.time}"> <div>You've been logged out due to inactivity.</div> </c:if> Username:<br> <input type="text" name="userName" value="" /> <br> <br> Password:<br> <input type="password" name="password" value="" /> <input value="Login" name="submit" type="submit" /> </form:form> logout.jsp： <a href="${pageContext.request.contextPath}/login.htm">Login</a> 这项工作很好,唯一的问题是当我点击登出时什么都没做,我仍然拥有登录后的权限.通常它应该回到登录界面,要求用户进行身份验证以访问该页面.我错过了什么？ 还有一个我无法想象的问题.当我在登录表单中更改时： <form:form action="${pageContext.request.contextPath}/login" method="POST"> 至： <form name='loginform' action="<c:url value='j_spring_security_check' />" method='POST'> 我收到一个错误： HTTP Status 404 – /Dronomy_2.1/j_spring_security_check 谁能帮我？