[FIXED] spring boot security doesn't let me access h2-console

Issue

I'm trying to implement JWT in Spring Boot. For some debugging purposes, I need an H2 console.

So in my WebSecurityConfiguration, I wrote :

@Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        //httpSecurity.headers().frameOptions().disable();
        httpSecurity.authorizeRequests().antMatchers("/h2").permitAll();
        httpSecurity
                .csrf().disable()
                .authorizeRequests()
                .antMatchers("/auth/check/username").permitAll()
                .antMatchers("/auth/signup").permitAll()
                .antMatchers("/auth/login").permitAll()
                .anyRequest().authenticated().and()
                .exceptionHandling().and().sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        httpSecurity.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);

    }

In my application properties, I have this configuration :

spring.h2.console.enabled=true
spring.h2.console.path=/h2

When I hit ":8080/h2", it gives me 403.

So the question remains, how can I properly configure Spring Boot Web Security.

After including /h2/**, I get this UI :

Solution

Please try "h2" pattern as:

httpSecurity.authorizeRequests().antMatchers("/h2/**").permitAll();

And this too :

httpSecurity.headers().frameOptions().disable();

more can found here : How to disable 'X-Frame-Options' response header in Spring Security?

Answered By - shabbeer ahammad
Answer Checked By - Marie Seifert (JavaFixing Admin)