CODEWITHSUNDEEP
javaspringspring-security
Eddy Freeman
Eddy Freeman

Reputation: 3309

Spring Security 3.1.3 Issues

I am using Spring Security 3.1.3.RELEASE in my maven pom because the book am reading is 2013 and that is what they used and have the following code snippets:

// AdminController 

@Controller
@RequestMapping("/admin")
public class AdminController {

    @RequestMapping(method=RequestMethod.POST, value="/movies")
    @ResponseBody
    public String createMovie(@RequestBody String movie) {
        System.out.println("Adding movie!! "+movie);
        return "created";
    }
}

// LoginController 

@Controller
@RequestMapping("")
public class LoginController {

    @RequestMapping(method= {RequestMethod.GET, RequestMethod.POST}, value="/custom_login")
    public String showLogin() {
        return "login";
    }
}

// web.xml

 <web-app>
      <display-name>Archetype Created Web Application</display-name>

      <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/applicationContext-security.xml</param-value>
      </context-param>

      <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
      </filter>
      <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
      </filter-mapping>

       <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
      </listener>

      <servlet>
        <servlet-name>terrormovies</servlet-name>
        <servlet-class> org.springframework.web.servlet.DispatcherServlet </servlet-class>
        <load-on-startup>1</load-on-startup>
      </servlet>
      <servlet-mapping>
        <servlet-name>terrormovies</servlet-name>
        <url-pattern>/</url-pattern>
      </servlet-mapping>
    </web-app>

// Spring security Config :: applicationContext-security.xml

<security:http auto-config="true">
        <security:intercept-url pattern="/admin/**/*" access="ROLE_ADMIN" />
        <security:form-login login-page="/custom_login"  username-parameter="user_param" password-parameter="pass_param"/>
    </security:http>
    <security:authentication-manager>
        <security:authentication-provider>
            <security:user-service>
                <security:user authorities="ROLE_ADMIN" name="admin" password="admin" />
            </security:user-service>
        </security:authentication-provider>
    </security:authentication-manager>

//login.jsp

<%@ page language="java" contentType="text/html; charset=ISO-8859-1" pageEncoding="ISO-8859-1"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
        <title>Terror movies</title>
    </head>
    <body>
        <form action="/j_spring_security_check" method="POST">
        Username<input type="text" name="user_param"/><br/>
        Password<input type="password" name="pass_param"/><br/>
        <input type="submit" value="Login"/>
        </form>
    </body>
    <% if(request.getParameter("error") != null){
            out.println("ERROR LOGIN");
        }
    %>
</html>

When I start my application I get the login page with the form alright. I enter admin/admin as username/password respectively. When i click on the login button I get this error page saying:

Problem accessing /admin/movies. Reason:

    Request method 'GET' not supported

Powered by Jetty://

instead of going to the method createMovie(@RequestBody String movie) in the AdminController.

The address of this error page is :: http://localhost:8080/admin/movies

The LoginController and AdminController are in the same package.

What am I missing here?

Updated

In the form action:: <form action="/j_spring_security_check" method="POST">, where does "/j_spring_security_check"` leads to? I think that is where the problem is. Am beginner in Spring Security so I can't figure it out now. I did a search but not any good answer.

Upvotes: 0

Views: 76

Answers (1)

jlumietu
jlumietu

Reputation: 6434

The error response message you are receiving tells you exactly what the problem is:

When i click on the login button i get this error page saying::

Problem accessing /admin/movies. Reason:

   Request method 'GET' not supported

Powered by Jetty://

And in your controller you have set this method:

@Controller
@RequestMapping("/admin")
public class AdminController {

    @RequestMapping(method=RequestMethod.POST, value="/movies")
    @ResponseBody
    public String createMovie(@RequestBody String movie) {
        System.out.println("Adding movie!! "+movie);
        return "created";
    }
}

And just as the message says, the /admin/movies method is mapped just for POST requests, so a GET request which is what is generated on redirection from the login success cannot be handled.

So here the trouble is not really the spring-security config, the problem is just that after login you are making a request to a request-mapping annotated method which does not support GET requests.

To solve it you could just configure this method into the existing AdminController:

@RequestMapping(method=RequestMethod.GET, value="/movies")
public String createMovieForm() {
    return "createMovieForm";
}

And create a jsp with a form which points to the POST mapped controller method:

<form action="/admin/movies" method="POST">
    Movie<input type="text" name="movie"/><br/>
    <input type="submit" value="Login"/>
</form>

I would be easier too if you delete the @RequestBody annotation in the POST method, so finally the AdminController should end like this:

@Controller
@RequestMapping("/admin")
public class AdminController {

    @RequestMapping(method=RequestMethod.POST, value="/movies")
    @ResponseBody
    public String createMovie(String movie) {
        System.out.println("Adding movie!! "+movie);
        return "created";
    }

    @RequestMapping(method=RequestMethod.GET, value="/movies")
    public String createMovieForm() {
        return "createMovieForm";
    }
}

Upvotes: 1

Related Questions