CODEWITHSUNDEEP
javaspringspring-bootmaven
Dylan Creaven
Dylan Creaven

Reputation: 23

How to implement security in a spring boot application?

I'm creating a spring application for a college project and need help implementing a login page

package com.sales.security;

import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter{ 
 @Override
 protected void configure(HttpSecurity http) throws Exception {
  http
    .authorizeRequests()
    .antMatchers("/showProducts.html", "/showOrders.html", "/showCustomers.html","/newOrder.html","/addProduct.html","/addCustomer.html")
    .authenticated()
    .and()
    .formLogin();
  }

 private static final String ENCODED_PASSWORD = "$2y$12$i4Cl5SZgrPFItSz/G5cvTObf0sqzHszwwKMZ4pQeUlElY1BR7KxdO"; //password is "user" encrypted using BCrypt


 @Override
 protected void configure(AuthenticationManagerBuilder auth) throws Exception {
     auth.inMemoryAuthentication()
         .passwordEncoder(passwordEncoder())
         .withUser("user").password(ENCODED_PASSWORD).roles("USER");
 }


 @Bean
 public PasswordEncoder passwordEncoder() {
     return new BCryptPasswordEncoder();
 }
}

I've taken the code from user TwiN at Java Spring Security - User.withDefaultPasswordEncoder() is deprecated?

I have changed the hash to be "user" and have confirmed it's definitely "user" using https://bcrypt-generator.com/

but no matter what now, the login page won't allow me to login and says that my login details are incorrect here's what my application looks like after entering a username="user" and password ="user"

Upvotes: 0

Views: 445

Answers (3)

Dylan Creaven
Dylan Creaven

Reputation: 23

I managed to fix it. 


package com.sales.security;

import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Bean
public PasswordEncoder getPasswordEncoder() {
    return NoOpPasswordEncoder.getInstance();
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {

    auth.inMemoryAuthentication()
        .withUser("user")
        .password("user")
        .roles("USER");
}

@Override
protected void configure(HttpSecurity http) throws Exception {

    http.authorizeRequests()
        .antMatchers("/showCustomers.html","/showProducts.html","/showOrders.html","/addCustomer.html","/newOrder.html","/addProduct.html").hasAnyRole("USER")
        .and()
        .formLogin()
        .and()
        .logout();
}

}

Upvotes: 0

user13259225
user13259225

Reputation:

You are encoding an already encoded password. Try something like this:

@EnableWebSecurity
public class WebConfig extends WebSecurityConfigurerAdapter {

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    BCryptPasswordEncoder encoder = passwordEncoder();
    auth.inMemoryAuthentication().withUser("user").password(encoder.encode("password")).roles("USER");
}

@Bean
public BCryptPasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

}

Upvotes: 1

Meysam Karimi
Meysam Karimi

Reputation: 97

please check your encrypted password again, it seem's your password didn't encrypted correctly.

Upvotes: 0

Related Questions