0

Help me please a little with setting up Spring Security. I found something similar, but it somehow does not work very well for me .. https://stackoverflow.com/a/36875726/1590594

The configuration specifies that each request must be authenticated. It is necessary to do the following, that on the specified URL ("/ push") worked only one filter. The filter does the appropriate checking and skips the request further or rejecting. Without authentication.

    @Override
protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable().
            sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and().
            authorizeRequests()
            .anyRequest().authenticated().
            and().
            anonymous().disable().
            exceptionHandling().authenticationEntryPoint(unauthorizedEntryPoint());
    http.addFilterBefore(new UserAuthenticationFilter(authenticationManager()), BasicAuthenticationFilter.class);
    http.authorizeRequests().antMatchers(HttpMethod.POST, "/push").authenticated().and().addFilterBefore(new RPushFilter(),BasicAuthenticationFilter.class);
}

and filter

    public class RPushFilter extends GenericFilterBean {
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;

        //IF NOT httpResponse.sendError(HttpStatus.BAD_REQUEST.value(), "Access denied");

        chain.doFilter(request, response);
    }
}
Latika Agarwal
  • 973
  • 1
  • 6
  • 11
JDev
  • 2,157
  • 3
  • 31
  • 57

0 Answers0