Issue
I would like intergrate Spring Security in my rest API. I have problem because my configration blocing all routes.
My configuration:
@Configuration
@EnableResourceServer
public class OAuth2ResourceServerConfig extends ResourceServerConfigurerAdapter {
@Override
public void configure(HttpSecurity http) throws Exception {
http.csrf().disable();
http.authorizeRequests()
.antMatchers("/").permitAll()
.antMatchers(HttpMethod.POST,"/api/getNews").hasRole("ADMIN");
}
}
When I want GET on http://localhost:8080/ spring returns login form
<html>
<head>
<title>Login Page</title>
</head>
<body onload='document.f.username.focus();'>
<h3>Login with Username and Password</h3>
<form name='f' action='/login' method='POST'>
<table>
<tr><td>User:</td><td><input type='text' name='username' value=''></td></tr>
<tr><td>Password:</td><td><input type='password' name='password'/></td></tr>
<tr><td colspan='2'><input name="submit" type="submit" value="Login"/></td></tr>
<input name="_csrf" type="hidden" value="5453a3c5-2573-4861-b777-d008b04863c3" />
</table>
</form>
</body>
</html>
But I have a rule for / to permit. Why I don't have access to my API?
Solution
Found next:
When using
permitAllit means every authenticated user, however you disabled anonymous access so that won't work.
Try this
This works for me, add example:
http.csrf().disable()
.anonymous().authorities("ROLE_ANONYMOUS")
.and()
.authorizeRequests()
.antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
.antMatchers(HttpMethod.GET, appConfigHolder.getSecurity().getLoginUrl()).permitAll()
Edited:
Problem was in Spring version. With v1.4.3.REALESE no problems.
Answered By - sf_
