Questions tagged [spring-security]
Spring Security is the Spring Framework's application security solution. Spring Security can be used to secure URLs and method invocations. It is widely used to secure standalone web applications and REST APIs.
28,381
questions
-1
votes
0
answers
4
views
OIDC1.0 SLO not working in Spring Authorization Server
I have one Spring Boot application using Spring Authorization Server 3.1.2. It is using OAuth2 and OIDC1.0 for Authentication. I have two clients one is the order-client ,and the other is product-...
-1
votes
0
answers
6
views
Issue Extracting Tokens in Spring Security 4.2.7 with Spring Authorization Server (Spring Security 6) and OIDC Flow
I have a dedicated Spring Authorization Server (Spring Security 6) where I've configured the OIDC flow with PKCE for authentication. I have two applications, one running Spring Security 5.7.5 and the ...
-1
votes
0
answers
24
views
wanted to add Producer data to my database through postman but giving 403 error plz help me
package com.odopapi.odop_shi.security;
import java.util.Arrays;
import java.util.Collections;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation....
-1
votes
0
answers
8
views
Trying to add add eureka discovery server to spring security and permit specific url using api gateway
I am new at microservice and trying to secure my service using jwt.
I am trying to permit eureka discovery server url from spring security throw api-gateway.
api-gateway url is localhost:8080 and ...
0
votes
0
answers
15
views
Unit Testing Controller Layer in Spring Boot 3 | Getting Error in Authentication
Hi I am trying to unit test a POST endpoint in my Controller Layer, but it gives me below error:
java.lang.NullPointerException: Cannot invoke "org.springframework.security.authentication....
0
votes
1
answer
30
views
Disable logout redirect and call custom logout rest end point in springboot 3
I am working on a springboot 3 application. I had to work with Jwt object so I had to import this dependency along with spring-boot-starter-security
<dependency>
<groupId>org....
1
vote
0
answers
15
views
Setting cookies on subsequent request in Spring Security filter
Our app uses 2 urls. One is "example.com" and another is "my.example.com". The former is the public domain of our app, whereas the latter is intended to be used by logged in users ...
1
vote
0
answers
25
views
Why does Spring Security favor service layer security over web request (controller layer) security?
I apologize for the title, as I am not entirely sure if it accurately reflects the topic I want to discuss.
In Spring Security Reference 15.5.1 General Questions - 2. Why not just use web.xml ...
0
votes
0
answers
16
views
Generic exception when developing Spring Boot 3 API with Insomnia
package com.example.hotel.repo.implementation;
import com.example.hotel.domain.Role;
import com.example.hotel.domain.User;
import com.example.hotel.exception.ApiException;
import com....
0
votes
0
answers
11
views
Multi-tenant WebSocket microservice based on String
Disclaimer
Following code works, I would only ask about approach and grab some feedback about general idea, because it's my first time with Spring WebSockets + Spring Security for WebSockets.
In the ...
-2
votes
2
answers
39
views
Migrating to Sping 6.X How to best migrate the Spring SecurityConfiguration for cors and matchers
I am moving to Spring framework 6 and I have the following spring framework 2 code:
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
/...
0
votes
0
answers
9
views
How to handle security (authn/authz) with DGS Subscriptions and spring security?
I'm mirroring a question asked directly on GitHub here.
I'm up to the point where if I authorize("/subscriptions",permitAll) while configuring my SecurityWebFilterChain then I can ...
-1
votes
1
answer
22
views
JWT expired issue in spring boot project
i am getting this error io.jsonwebtoken.ExpiredJwtException: JWT expired at 2023-09-16T01:00:37Z. Current time: 2023-09-21T18:16:53Z, ...
0
votes
1
answer
53
views
How can one cache Oauth2 tokens using Spring Security and WebClient?
How can configure refresh token requests and caching of Oauth2 tokens using Spring Security, WebClient and Spring Boot 3.1.3?
I would like to configure a service with the following flow:
polls ...
0
votes
1
answer
23
views
Spring security expression sec:authorize dont work
I want to show a tag for login to an anonymous user and an a tag for logout tu authenticated user that have ROLE_USER im using the sec:authorize but it doesn't do nothing, dont give me error just dont ...
-1
votes
0
answers
37
views
Spring security return 403 on all POST, PUT request
I write Spring Boot appliction and use Spring security. I'm testing through POSTMAN and swagger UI. GET requests working. But all POST and PUT request return 403 error.
I`m disable cors and csrf but ...
-1
votes
0
answers
19
views
No user information was obtained after logging in with springsecurity
I started the project and used postman to test the interface. After I tested the login function, I continued to test the interface to get user information, but this time a 500 error was reported and ...
0
votes
1
answer
42
views
API calls failing during Spring security default authentication
I am trying to incorporate password hashing using Bcrypt which required me to add spring security to my project. The issue that I am facing is that whenever I try to call any of my APIs I get the ...
-2
votes
1
answer
43
views
in spring boot 3.1.3 i have a problems with .csrf() .sessionManagement() .and() error is 'csrf()' is deprecated and marked for removal?
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception{
http
.csrf()
.disable()
.authorizeRequests()
...
1
vote
1
answer
43
views
Spring Security cannot be authenticated
When the loadUserByUsername function return ShopmeUserDetails(user), then it cannot be authenticated. But when return the User details it works without issue.
Below not work, which return the new ...
0
votes
2
answers
53
views
Problem with Authentication (SPRING SECURITY)
I have a problem, I'm using spring security to create endpoint login. After login success the response with token will be created. But when I using postman to send request(I'm using correct method, ...
0
votes
1
answer
45
views
Is a Secure Oauth2 Web App Flow with FE and BE the right approach?
We have a Web Application that mints an internal JWT used for authentication along with a secure cookie. As the organization has been moving to Okta there is an ask to integrate that login flow into ...
0
votes
0
answers
14
views
Connecting Flutter with Websocket Spring Security STOMP
I've been struggling for days trying to find a guide or something to connect my flutter app to the Websocket in my backend. It's all new to me... Nothing happens in the console of my backend but I ...
0
votes
1
answer
45
views
Spring Security 6, Angular 13 CORS problem OPTIONS request
i have this application in Springboot for the backend and the angular app as frontend my problem is that when i perform a http get call from angular to the backend it response me with a
'Access to ...
0
votes
1
answer
34
views
@PreAuthorize not working in spring security 6.1.3 in spring 3.1.3
I am facing a problem using Spring security @PreAuthorize annotation. I have followed many tutorials and theorically I am making everything right but for some reasons it doesn't work.
All I wanted to ...
0
votes
1
answer
26
views
How to convert old spring boot 2 security configuration WebSecurityConfigurerAdapter based to new Spring boot 3 securityConfig
I have this spring boot 2 security class based on WebSecurityConfigurerAdapter
import com.example.springsocial.security.*;
import com.example.springsocial.security.oauth2.CustomOAuth2UserService;
...
0
votes
1
answer
21
views
Spring Boot - Security/JPA - Insert to the database when getting a response from the handler
I want to insert a successful or failed login to the database depending on whether the user entered their credentials correctly or not.
If the user enters their credentials incorrectly, the ...
0
votes
0
answers
22
views
Spring Boot Filter called in anonymous request
Lil problem with Spring Security: I have two 'main-endpoints' in my app. /authenticated/** & /anonymous/**. The name of each endpoint is pretty much what I also want Spring Boot to do.
...
0
votes
0
answers
40
views
How do I modify a response's ReadOnlyHttpHeaders in Spring WebFlux?
Recently I met some trouble things, this problem bothered me for a month, I don't know how to solve, online also can't find any relevant information, I'm going crazy.
I didn't set the http header, it ...
-1
votes
0
answers
39
views
Log in with postgres DBMS users in Spring Security
I have the following problem, I am developing a web application with spring boot, spring security and jdbc. I need that once the user clicks on the authenticate button in the login form, my ...
0
votes
2
answers
54
views
OAuth2 token introspection for each service request?
I've implemented a Spring based REST API (resource server) that uses the OAuth2 authorization code flow. The receives an opaque access token from the client and validated this token through a custom ...
2
votes
0
answers
84
views
ERR_TOO_MANY_REDIRECTS. State parameter not saved in database when oauth2 authorization server issues an authorization code to a client
I'm trying to replicate the oauth 2.0 authorization code flow with the following 3 projects, but, as you can see by the title, I'm struggling in getting redirected to the client server after I'm ...
0
votes
0
answers
21
views
Updating from Spring Security 2.0 to Spring Security 3.2.9
I have updated my security-sso-beans.xml to the below code when migrating from Spring Security 2.0.2 to Spring Security 3.2.9. I am getting access denied error and JSON-error creating beans. Can you ...
1
vote
2
answers
29
views
My spring application does not start, it is giving an error in the class configuration even without having changed anything related to this
/usr/bin/env /usr/lib/jvm/jdk-17-oracle-x64/bin/java @/tmp/cp_4p3poytlo5gc9l704f0d0siz2.argfile com.lacertech.lacereats.LacerEatsAp
plication
. ____ _ __ _ _
/\\ / ___'_ __ ...
0
votes
0
answers
13
views
Spring security @PreFilter & @PostFilter for reactive methods
Is there an example of using @PostFilter ACL's in spring-security on a domain object say X , which is reactive ? For example, the method signature would be
public Flux<X> repositoryMethod().
I ...
-2
votes
0
answers
13
views
Facing issue while updating the library of spring-boot-starter-parent class [closed]
Context : In order to mitigate the vulnerabilities for spring-security-web and spring-security-config we have updated the dependency version for spring-boot-starter-parent from 3.1.1 to 3.1.3 which is ...
-1
votes
0
answers
25
views
When calling loadUserByUserName in springboot, arguments are not passed successfully
In spring security 3.1.2, the value in the json received from the client is correctly populated, but when I call loadUserByUsername it does not exceed this value, so the login request fails.
I tried ...
0
votes
0
answers
47
views
How to block endpoints by condition. AntMatchers does not recognize path variables
I have a Spring Boot application, with a property in the .properties file. I would like to be able to block/enable some endpoints based on condition.
I've currently created two beans annotated with @...
0
votes
1
answer
35
views
Spring security 6: override token validation (jwk-set-uri specific)
I need to integrate spring security with the oidm identity provider.
The issue is that this idp has a GET type validation url that does not follow the standard.
https://xxxxx.domain/oauth2/rest/token/...
0
votes
1
answer
61
views
SPEL Injection Security concerns for using SPEL
We are planning to use SPEL in our SaaS based product to execute conditional expressions. My requirement is to use evaluate conditions where user can write conditional expressions using variables, ...
-1
votes
1
answer
41
views
Spring Security Login with static user dont work
I'm trying to implement a basic spring security login
My security config class is this:
package com.bookshelf2.demo;
import org.springframework.context.annotation.Bean;
import org.springframework....
0
votes
1
answer
53
views
Multiple instances of Spring Authorization Server
I'm currently building a backend using Spring to build a backend and authenticating using Spring Authorization Server. After some trial and error, this is now working and authenticates the user with ...
-2
votes
1
answer
56
views
Updating to Spring Security 6.0 - failing unit tests after the replacing removed functionality [closed]
I'm trying to upgrade to Spring Boot 3.0.0 and Spring Security 6.0.
The old version of the configuration file looks like this:
import somecompany.verification.components.PreAuthFilter;
import ...
-1
votes
0
answers
17
views
postFilter - alternative way of handling
I want to know is there a way to use a filter/interceptor to achieve the same what I am able to achieve using postFilter in the below sample code snippet. I want to add this postFilter in multiple ...
0
votes
0
answers
40
views
How to stop too many redirects in springboot - react - google auth bundled app - securityconfig
I am stuck with too many redirects problem
The initial example code I used is
https://github.com/callicoder/spring-boot-react-oauth2-social-login-demo/tree/master
The example app runs ok if spring and ...
-1
votes
1
answer
53
views
Spring Boot - No SecurityContext found in WebSession
Currently I have a spring cloud gateway service and a number of other services. The gateway intercepts each request, checks if authorization is present and according allows/denies accessing a certain ...
-2
votes
0
answers
13
views
Too Many Redirects - Spring Security Form Login [duplicate]
I'm getting too many redirects error.
application.properties
spring.mvc.view.prefix=/WEB-INF/jsp/
spring.mvc.view.suffix:.jsp
MySecurityConfig.java
@Configuration
@EnableWebSecurity
public class ...
0
votes
1
answer
53
views
Where to inject custom audit service in a spring boot application
I have a multi-module spring boot app, and every module has a dependency on an audit service (which is defined in a 'helper' module, only has a method called audit() and all it actually does is ...
0
votes
0
answers
24
views
Error creating bean with name JwtUtill Requested Bean currently in creation mode [closed]
Error creating bean with name JwtUtill Requested Bean currently in creation mode is coming. Error is coming while launching spring boot app. I am try to implement JWT with Spring security. Whole code ...
-1
votes
0
answers
29
views
Spring security configuration for multiple APi's and multiple types of users
So, I am making this portal for bus reservation in which I have multiple modules and APIs
but I am facing issues with spring security. So, I have one table for all types of users (admin and regular ...