1

I'm developing an application using spring-social that allow users to connect via facebook with no sign-up at all, just click the connect button and you are logged in.

I am tracking the user via a cookie and making calls to Facebook on behalf of the user using a RESTful API. In case the user is not logged in an oauth exception will redirect him to the sign-in page where he needs to connect with Facebook - This is the service side.

There is also a website (or dashbboard) that allows the user to connect via a web-browser and see some statistics and manage his profile.

I want to enforce the same sign-up logic for the website.

I.e. no one can access a page if he is not authenticated (i.e sends a valid cookie with the request).

What would be the best way to enforce that on all the resources using Spring Social and Spring security? (remember, no user/pass, just cookies)

P.S. I built up my project on top of Spring-social quick-start example. This project has a HandlerInterceptorAdapter that make sure that all requests go through that adapter to check if the user-provided cookie is in the database, if it is it setup a SecurityContext with the user information and continue. I want to re-use this adapter for the web-site login flaw.

Tnx!

2
  • It is two different web applications? Jan 11, 2013 at 15:17
  • There's an API (just like facebook). myservice.com/doSomething, and there's also a web-profile (dashboard) myservice.com, they both communicate with the same API so you can look at this as 1 web app. Jan 11, 2013 at 15:26

1 Answer 1

1

You can secure all website URLs with SpringSecurity. If user is not authenticated then it will be redirected to login page. On the login page you can place SpringSocial signup button (instead of usual login form). After clicking on this button user will be redirected to Facebook. After successfull authentification it will be redirected to your application. SpringSocial can automatically inform SpringSecurity that user is already authenticated. So this user will be able use all website URLs without any problems.

EDIT. Normally you need to permit an access for all users on login page. In your case you need to do it for ProviderSignInController too (/signin).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.