ivans
ivans

Reputation: 11

Spring security redirects on login page on every axios request

When I perform axios calls to server it always returns 302.

Here is axios configuration:

const api = axios.create({
  baseURL: "http://localhost:8080",
});

api.interceptors.request.use(
  (config) => {
    const token = localStorage.getItem("token") || null;
    const basicAuthHeader = "Bearer " + token;
    config.headers.Authorization = basicAuthHeader;
    return config;
  },
  (error) => {
    console.log("Error in setting axios interceptor request");
  }
);

export default api;

Here is axios get function:

export async function getAllUserTeams(userId) {
  const response = await api.get(`/api/users/${userId}/getAllUserTeams`);
  return response.data;
}

On server this is security configuration:

@Bean
    SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception{

        http.securityContext(context -> context.requireExplicitSave(false))
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.ALWAYS))
                .cors(corsCustomizer -> corsCustomizer.configurationSource(new CorsConfigurationSource(){
                    @Override
                    public CorsConfiguration getCorsConfiguration(HttpServletRequest request) {
                        CorsConfiguration config = new CorsConfiguration();
                        config.setAllowedOrigins(Collections.singletonList("http://localhost:5173"));
                        config.setAllowedHeaders(Collections.singletonList("*"));
                        config.setAllowedMethods(Collections.singletonList("*"));
                        config.setAllowCredentials(true);
                        config.setMaxAge(3600L);

                        config.setExposedHeaders(List.of("Authorization"));
                        return config;
                    }
                }))
                .csrf(AbstractHttpConfigurer::disable)
                .authorizeHttpRequests(request ->
                        request.requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
                                .requestMatchers(HttpMethod.GET, "/basicAuth/**").permitAll()
                                .requestMatchers(HttpMethod.POST, "/register").permitAll()
                                .requestMatchers(HttpMethod.GET, "/").permitAll()
                                .requestMatchers("/admin/**").hasRole("ADMIN")
                                .requestMatchers("/api/**").authenticated()
                                )
                .addFilterBefore(new JWTTokenValidatorFilter(), BasicAuthenticationFilter.class)
                .addFilterAfter(new JWTTokenGeneratorFilter(), BasicAuthenticationFilter.class)
                .formLogin(Customizer.withDefaults())
                .httpBasic(Customizer.withDefaults());

        return http.build();
    }

I've tried to trace and debug spring security and all I see is that some "Match" is found and then redirected to "localhost:8080/login".

Upvotes: 0

Views: 20

Answers (0)

Related Questions