CODEWITHSUNDEEP
spring-bootspring-securityspring-security-rest
user16093823
user16093823

Reputation: 1

Spring-Security.. 5.1.5 RELEASE to Spring -Security.. 5.4.6 breaks security configuration

Summary Updated Spring boot project from 2.1.5 RELEASE to 2.4.5 Version. It automictically updated all Spring Security dependencies from version Spring-Security.. 5.1.5 RELEASE to Spring -Security.. 5.4.6 breaks security configuration

Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is java.lang.IllegalStateException: Can't configure anyRequest after itself at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:185) ~[spring-beans-5.3.6.jar:5.3.6] at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653) ~[spring-beans-5.3.6.jar:5.3.6] ... 28 more Caused by: java.lang.IllegalStateException: Can't configure anyRequest after itself at org.springframework.util.Assert.state(Assert.java:76) ~[spring-core-5.3.6.jar:5.3.6] at org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry.anyRequest(AbstractRequestMatcherRegistry.java:72) ~[spring-security-config-5.4.6.jar:5.4.6] at com.verizon.wfm.nt.config.SecurityConfig.configure(SecurityConfig.java:14) ~[default/:?] at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.getHttp(WebSecurityConfigurerAdapter.java:217) ~[spring-security-config-5.4.6.jar:5.4.6]

security configuration Working code

@EnableWebSecurity
@configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter{
@override
protected void configure(HttpSecurity httpSecurity) throws Exception {
super.configure(httpSecurity);
httpSecurity.authorizeRequests().anyRequest().permitAll();
httpSecurity.csrf().disable();
httpSecurity.headers().frameOptions().disable();
}
}

Upvotes: 0

Views: 908

Answers (1)

Marcus Hert da Coregio
Marcus Hert da Coregio

Reputation: 6308

When calling super.configure(httpSecurity) it does the following:

http.authorizeRequests((requests) -> requests.anyRequest().authenticated());
http.formLogin();
http.httpBasic();

After that, you are configuring the requests using the anyRequest again. It is not allowed in recent versions of Spring Security.

What I suggest you do is not calling the super.configure(httpSecurity) and instead disabling the defaults and configuring them, like so:

@EnableWebSecurity
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter{
    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity.formLogin().disable();
        httpSecurity.httpBasic().disable();
        httpSecurity.authorizeRequests((requests) ->
            requests.anyRequest().permitAll()
        );
        httpSecurity.csrf().disable();
        httpSecurity.headers().frameOptions().disable();
    }
}

Upvotes: 0

Related Questions