CODEWITHSUNDEEP
javaspringspring-mvcjakarta-eespring-security
AndreaNobili
AndreaNobili

Reputation: 42957

How can I exclude a specific resource from Spring Security management and make it accessible also to the not logged users?

I am pretty new in Spring Security and I have the following problem.

I have this controller method that handle request toward the /riepilogoCentrale resource

@RequestMapping(value = "/riepilogoCentrale", method = RequestMethod.GET)
public String riepilogoUtenteCentrale(HttpServletRequest request, Model model, Locale locale) {
    System.out.println("INTO riepilogoUtenteCentrale()");
    return "centrale/riepilogoCentrale";
}

My problem is that this resource (so the related rendered page) have to be accessible to everyone (also the not logged user) and as it is actually configured Spring Security if I try to access to this resource as visitor (not logged user) Spring redirects me to the log in page.

This is my Spring Security configuration file (named spring-security.xml):

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security" 
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
                        http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
                        http://www.springframework.org/schema/security 
                        http://www.springframework.org/schema/security/spring-security-4.0.xsd">

      <http pattern="/resources/**" security="none"/>
       <http auto-config="true"  use-expressions="true" authentication-manager-ref="authenticationManager">
        <intercept-url pattern="/login" access="permitAll" />
        <intercept-url pattern="/registrati" access="permitAll" />
        <intercept-url pattern="/salvaRegistrazione" access="permitAll" />
        <intercept-url pattern="/captcha.html" access="permitAll" />

        <intercept-url pattern="/**" access="isAuthenticated()" />
        <logout logout-success-url="/login" logout-url="/logout" />
        <form-login  login-page="/login"  
                     authentication-failure-url="/login?error=true"
                    default-target-url="/"
                    username-parameter="nomeUtente"
                    password-parameter="password"
                    login-processing-url="/j_spring_security_check"/>
        <csrf disabled="true"/>

    </http> 

    <authentication-manager id="authenticationManager" >
        <authentication-provider>
            <jdbc-user-service data-source-ref="datasource" 
                users-by-username-query="select des_usr_par, des_psw_par,true from TID001_ANAGPARTECIPA where des_usr_par =?"
                 authorities-by-username-query="select des_usr_par, prg_par from TID001_ANAGPARTECIPA where des_usr_par = ? "/>

        </authentication-provider>
    </authentication-manager>

</beans:beans>

So, how can I exclude the /riepilogoCentrale from the Spring Security management and make it accessible also to the not logged users ?

Upvotes: 2

Views: 767

Answers (2)

Makoto
Makoto

Reputation: 106400

You're already doing this for some of your resources; for example:

<intercept-url pattern="/salvaRegistrazione" access="permitAll" />

I would imagine that you'd add another intercept-url value including /riepilogoCentrale as the pattern, and implement other business logic inside of your controller based on whether or not the user is authenticated.

Upvotes: 1

Kayz
Kayz

Reputation: 667

You are already excluding some resources. 

<http pattern="/resources/**" security="none"/>

Just add the same entry with your riepilogoCentrale-resource.

Upvotes: 1

Related Questions