CODEWITHSUNDEEP
spring-mvcspring-security
Mariusz
Mariusz

Reputation: 1985

Two DispatcherServlets and DelegatingFilterProxy do not work together

There ara two DispatcherServlets in my app. One is for jsp service and dispatches admin's addresses.

<servlet>
    <servlet-name>adminServlet</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/spring/appServlet/adminServlet-context.xml</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
</servlet>

<servlet-mapping>
    <servlet-name>adminServlet</servlet-name>
    <url-pattern>/</url-pattern>
</servlet-mapping>

Second DispatcherServlet dispatches addresses where xml or json are sending. 

<servlet>
    <servlet-name>userServlet</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/spring/appServlet/userServlet-context.xml</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
</servlet>

<servlet-mapping>
    <servlet-name>userServlet</servlet-name>
    <url-pattern>/user/*</url-pattern>
</servlet-mapping>

There is also DelegatingFilterProxy to ensure security

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

Security context configuration file:

<http auto-config="true" use-expressions="true">
    <intercept-url pattern="/login.do"
        access="permitAll" requires-channel="http" />
    <intercept-url pattern="/*"
        access="hasRole('ROLE_USER')" requires-channel="http" />
    <intercept-url pattern="/admin/*"
        access="hasRole('ROLE_ADMIN')" requires-channel="http" />
    <form-login login-page="/login.do"
        login-processing-url="/loginProcess" username-parameter="user"
        password-parameter="password" default-target-url="/admin" />
    <logout logout-url="/logout.do"
        invalidate-session="true" />
    <remember-me key="secCh4"
        token-validity-seconds="3600" data-source-ref="dataSource" />
    <session-management
        session-fixation-protection="newSession">
    </session-management>
    <intercept-url pattern="/user/*" access="hasRole('ROLE_USER')" />
</http>

The part of service which is dispatched by adminServlet need authentication and is secured, but the part which is dipatched by userServlet is completely unsecured and any authentication is not necessary. I don't know why, I set url-pattern in DelegatingFilterProxy to /* and i also set

<intercept-url pattern="/user/*" access="hasRole('ROLE_USER')" />

Any ideas?

Upvotes: 2

Views: 1230

Answers (1)

sinuhepop
sinuhepop

Reputation: 20316

DelegatingFilterProxy has nothing to do with DispatcherServlet. In fact, Spring MVC is not needed and you can use any other frame, like Struts.

With your rule <intercept-url pattern="/user/*" access="hasRole('ROLE_USER')" /> you are specifying to intercept urls like /user/list/ or /user/4, but not /user/4/save. If you want to intercept all urls starting with /user/ try with <intercept-url pattern="/user/**" access="hasRole('ROLE_USER')" />. You can read a little more here.

Anyway, remember that intercept-url order is important, too.

Upvotes: 2

Related Questions