CODEWITHSUNDEEP
springspring-security
Volodymyr O
Volodymyr O

Reputation: 73

Spring security not secure root path

In my opition this config should allow security on all pages of site from root

After visit site.com i see main page, but should be redirected to login page

@Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf()
                .disable()
                .authorizeRequests()
                .antMatchers("/resources/**").permitAll()
                .antMatchers("/register").permitAll()
                .antMatchers("/login").permitAll()

                .and();

        http.formLogin()
                .loginPage("/login")
                .loginProcessingUrl("/j_spring_security_check")
                .successHandler(getAuthenticationSuccess())
                .failureUrl("/login?error=accessDenied")
                .usernameParameter("j_username")
                .passwordParameter("j_password")
                .permitAll()
                .and()
                .authorizeRequests()
                .antMatchers("/**").authenticated()
                .anyRequest().authenticated()
                .and();
        http.logout()
                .logoutSuccessUrl("/")
                .logoutUrl("/logout")
                .permitAll();

        http.headers().xssProtection();

Upvotes: 2

Views: 2483

Answers (1)

Ahmad
Ahmad

Reputation: 1474

you should logout after see the main page if you want to redirect to login page, enter login url to logout success url

http.formLogin()
                .loginPage("/login")
                .loginProcessingUrl("/j_spring_security_check")
                .successHandler(getAuthenticationSuccess())
                .failureUrl("/login?error=accessDenied")
                .usernameParameter("j_username")
                .passwordParameter("j_password")
                .permitAll()
                .and()
                .authorizeRequests()
                .antMatchers("/**").authenticated()
                .anyRequest().authenticated()
                .and()
                .logout()
                .logoutSuccessUrl("/login")
                .permitAll();

Upvotes: 2

Related Questions