CODEWITHSUNDEEP
springspring-security
starman1979
starman1979

Reputation: 1084

Spring security - Getting 404 error for REST call

I have an application that I am securing using Spring Security. I enable it using the annotations:

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

I then configure it by overriding the configure() method:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .csrf()
    .and()
        .addFilterAfter(new CsrfCookieGeneratorFilter(), CsrfFilter.class)
        .exceptionHandling()
        .accessDeniedHandler(new CustomAccessDeniedHandler())
        .authenticationEntryPoint(authenticationEntryPoint)
    .and()
        .formLogin()
        .loginProcessingUrl("/api/authentication")
        .successHandler(ajaxAuthenticationSuccessHandler)
        .failureHandler(ajaxAuthenticationFailureHandler)
        .usernameParameter("username")
        .passwordParameter("password")
        .permitAll()
    .and()
        .logout()
        .logoutUrl("/api/logout")
        .logoutSuccessHandler(ajaxLogoutSuccessHandler)
        .deleteCookies("JSESSIONID", "CSRF-TOKEN")
        .permitAll()
    .and()
        .headers()
        .frameOptions()
        .disable()
    .and()
        .authorizeRequests()
        .antMatchers("/api/**").authenticated()
        .antMatchers("/admin/**").hasAuthority(AuthoritiesConstants.ADMIN);
}

I'm getting redirected correctly to the login page when I try to get to the home page, but once I enter my credentials and try to login, I get the 404 not found error for /api/authentication REST call.

The loginProcessingUrl() method specifies the call to make. I don't have to implement this myself do I, as Spring should do that for me? Is there anything else I'm missing?

Upvotes: 0

Views: 1931

Answers (2)

starman1979
starman1979

Reputation: 1084

I figured it out, it was a couple of things I needed to change:

  1. I didn't have an Initializer class. After I added the following class, I went from a 404 not found error, to a 403 error:

    public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer { }

Note: you can also add the corresponding filter in your web.xml (read more here: http://websystique.com/spring-security/spring-security-4-hello-world-annotation-xml-example/)

  1. The above change registers security with the Spring container. But I still needed to disable CSRF, as I wasn't sending the proper tokens from the client side. For my application, I don't need CSRF just yet so I have disabled it for now. However, this is not recommended so make sure sure you know what you are doing before making this change:

    http.csrf().disable()

Upvotes: 0

Sam
Sam

Reputation: 73

As far as I understood the login-processing-url, you have to handle the login process by yourself if you specify a special url to process the login.

Have you tried to just remove this line?:

.loginProcessingUrl("/api/authentication")

As you use springs default login form, you should just be able to remove the line and the generated login form will also change.

Maybe there's another way to solve your problem but this should also work.

If you're looking for an example on how to use custom login forms, this link might helo you.

Upvotes: 1

Related Questions