CODEWITHSUNDEEP
springspring-securityspring-boot
SheppardDigital
SheppardDigital

Reputation: 3255

Spring boot security, applying an authentication filter only to certain routes

I'm building a web application which will contain an API and an admin interface in a single application. As a result, I need two types of authentication, token based auth for the API, and form based auth for the admin interface.

I've almost got it working by applying a filter to authenticate API tokens, however the filter is being executed for every request, and I only want it to be executes on paths matching '/api/**'.

Hopefully it's clear from my security configuration what I'm trying to do, but sadly it doesn't work as expected.

All API requests will start '/api/', while all admin interface requests will start '/admin/'. So I was hoping to apply different security rules to each.

@Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().antMatchers("/api/account/login").permitAll();
        http.addFilterBefore(webServiceAuthenticationFilter, UsernamePasswordAuthenticationFilter.class).authorizeRequests().antMatchers("/api/**").hasAuthority("APIUSER");

        http.authorizeRequests().antMatchers("/admin/**").authenticated().and()
            .formLogin()
                .loginPage("/admin/account/login").permitAll()
                .passwordParameter("password")
                .usernameParameter("username")
                .failureUrl("/admin/account/login?error").permitAll()
                .defaultSuccessUrl("/admin/dashboard")
                .and()
            .logout()
                .logoutRequestMatcher(new AntPathRequestMatcher("/admin/account/logout"))
                .logoutSuccessUrl("/admin/account/login");

        http.exceptionHandling().accessDeniedPage("/admin/account/forbidden");
    }

Upvotes: 4

Views: 7949

Answers (2)

Andreas Jägle
Andreas Jägle

Reputation: 12240

There is a way to configure several HttpSecuritys depending on the url by using the antMatcher (or in more advanced cases requestMatchers) on the HttpSecurity directly (not on authorizeRequests!). See: https://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/config/annotation/web/builders/HttpSecurity.html#antMatcher-java.lang.String-

This requires defining several WebSecurityConfigurerAdapters with defined @Orders such that Spring uses the first appropriate configuration depending on the given url and the order of the configurations. For more details please take a look at the docs at http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#multiple-httpsecurity

Upvotes: 4

SheppardDigital
SheppardDigital

Reputation: 3255

I don't know if this is the 'correct' way of doing it, but I've managed to only get the filters code to execute when a route is matched with '/api/**' by adding an if statement to the filter itself;

So within my filter I have the following;

AntPathMatcher urlMatch = new AntPathMatcher();
if (urlMatch.match("/api/**", httpRequest.getRequestURI().substring(httpRequest.getContextPath().length()))) {
    // Token authentication in here
}

Upvotes: 0

Related Questions