Questions tagged [spring-security]

Spring Security is the Spring Framework's application security solution. Spring Security can be used to secure URLs and method invocations. It is widely used to secure standalone web applications and REST APIs.

Filter by
Sorted by
Tagged with
-1 votes
0 answers
4 views

OIDC1.0 SLO not working in Spring Authorization Server

I have one Spring Boot application using Spring Authorization Server 3.1.2. It is using OAuth2 and OIDC1.0 for Authentication. I have two clients one is the order-client ,and the other is product-...
Sunxpin's user avatar
-1 votes
0 answers
6 views

Issue Extracting Tokens in Spring Security 4.2.7 with Spring Authorization Server (Spring Security 6) and OIDC Flow

I have a dedicated Spring Authorization Server (Spring Security 6) where I've configured the OIDC flow with PKCE for authentication. I have two applications, one running Spring Security 5.7.5 and the ...
Bhushan Rohankar's user avatar
-1 votes
0 answers
24 views

wanted to add Producer data to my database through postman but giving 403 error plz help me

package com.odopapi.odop_shi.security; import java.util.Arrays; import java.util.Collections; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation....
Aryan's user avatar
  • 1
-1 votes
0 answers
8 views

Trying to add add eureka discovery server to spring security and permit specific url using api gateway

I am new at microservice and trying to secure my service using jwt. I am trying to permit eureka discovery server url from spring security throw api-gateway. api-gateway url is localhost:8080 and ...
Mehadi Hasan's user avatar
0 votes
0 answers
15 views

Unit Testing Controller Layer in Spring Boot 3 | Getting Error in Authentication

Hi I am trying to unit test a POST endpoint in my Controller Layer, but it gives me below error: java.lang.NullPointerException: Cannot invoke "org.springframework.security.authentication....
Saksham98's user avatar
0 votes
1 answer
30 views

Disable logout redirect and call custom logout rest end point in springboot 3

I am working on a springboot 3 application. I had to work with Jwt object so I had to import this dependency along with spring-boot-starter-security <dependency> <groupId>org....
manjosh's user avatar
  • 438
1 vote
0 answers
15 views

Setting cookies on subsequent request in Spring Security filter

Our app uses 2 urls. One is "example.com" and another is "my.example.com". The former is the public domain of our app, whereas the latter is intended to be used by logged in users ...
Joe D's user avatar
  • 54
1 vote
0 answers
25 views

Why does Spring Security favor service layer security over web request (controller layer) security?

I apologize for the title, as I am not entirely sure if it accurately reflects the topic I want to discuss. In Spring Security Reference 15.5.1 General Questions - 2. Why not just use web.xml ...
Jacky Wang's user avatar
  • 3,303
0 votes
0 answers
16 views

Generic exception when developing Spring Boot 3 API with Insomnia

package com.example.hotel.repo.implementation; import com.example.hotel.domain.Role; import com.example.hotel.domain.User; import com.example.hotel.exception.ApiException; import com....
Ijaas Fouzer's user avatar
0 votes
0 answers
11 views

Multi-tenant WebSocket microservice based on String

Disclaimer Following code works, I would only ask about approach and grab some feedback about general idea, because it's my first time with Spring WebSockets + Spring Security for WebSockets. In the ...
Piotr Olaszewski's user avatar
-2 votes
2 answers
39 views

Migrating to Sping 6.X How to best migrate the Spring SecurityConfiguration for cors and matchers

I am moving to Spring framework 6 and I have the following spring framework 2 code: @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http /...
HeronAlgoSearch's user avatar
0 votes
0 answers
9 views

How to handle security (authn/authz) with DGS Subscriptions and spring security?

I'm mirroring a question asked directly on GitHub here. I'm up to the point where if I authorize("/subscriptions",permitAll) while configuring my SecurityWebFilterChain then I can ...
Crystark's user avatar
  • 3,723
-1 votes
1 answer
22 views

JWT expired issue in spring boot project

i am getting this error io.jsonwebtoken.ExpiredJwtException: JWT expired at 2023-09-16T01:00:37Z. Current time: 2023-09-21T18:16:53Z, ...
Srilatha Nandamuri's user avatar
0 votes
1 answer
53 views

How can one cache Oauth2 tokens using Spring Security and WebClient?

How can configure refresh token requests and caching of Oauth2 tokens using Spring Security, WebClient and Spring Boot 3.1.3? I would like to configure a service with the following flow: polls ...
matsev's user avatar
  • 32.2k
0 votes
1 answer
23 views

Spring security expression sec:authorize dont work

I want to show a tag for login to an anonymous user and an a tag for logout tu authenticated user that have ROLE_USER im using the sec:authorize but it doesn't do nothing, dont give me error just dont ...
Niccoló Balzarotti's user avatar
-1 votes
0 answers
37 views

Spring security return 403 on all POST, PUT request

I write Spring Boot appliction and use Spring security. I'm testing through POSTMAN and swagger UI. GET requests working. But all POST and PUT request return 403 error. I`m disable cors and csrf but ...
Miha5418's user avatar
-1 votes
0 answers
19 views

No user information was obtained after logging in with springsecurity

I started the project and used postman to test the interface. After I tested the login function, I continued to test the interface to get user information, but this time a 500 error was reported and ...
Mazai's user avatar
  • 1
0 votes
1 answer
42 views

API calls failing during Spring security default authentication

I am trying to incorporate password hashing using Bcrypt which required me to add spring security to my project. The issue that I am facing is that whenever I try to call any of my APIs I get the ...
stan3098's user avatar
-2 votes
1 answer
43 views

in spring boot 3.1.3 i have a problems with .csrf() .sessionManagement() .and() error is 'csrf()' is deprecated and marked for removal?

public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception{ http .csrf() .disable() .authorizeRequests() ...
Ayana USUBALIEVA's user avatar
1 vote
1 answer
43 views

Spring Security cannot be authenticated

When the loadUserByUsername function return ShopmeUserDetails(user), then it cannot be authenticated. But when return the User details it works without issue. Below not work, which return the new ...
Roberto Ambrosio's user avatar
0 votes
2 answers
53 views

Problem with Authentication (SPRING SECURITY)

I have a problem, I'm using spring security to create endpoint login. After login success the response with token will be created. But when I using postman to send request(I'm using correct method, ...
Quan Pham's user avatar
0 votes
1 answer
45 views

Is a Secure Oauth2 Web App Flow with FE and BE the right approach?

We have a Web Application that mints an internal JWT used for authentication along with a secure cookie. As the organization has been moving to Okta there is an ask to integrate that login flow into ...
IcedDante's user avatar
  • 6,205
0 votes
0 answers
14 views

Connecting Flutter with Websocket Spring Security STOMP

I've been struggling for days trying to find a guide or something to connect my flutter app to the Websocket in my backend. It's all new to me... Nothing happens in the console of my backend but I ...
Todoroki Attack's user avatar
0 votes
1 answer
45 views

Spring Security 6, Angular 13 CORS problem OPTIONS request

i have this application in Springboot for the backend and the angular app as frontend my problem is that when i perform a http get call from angular to the backend it response me with a 'Access to ...
Matteo Vigilante's user avatar
0 votes
1 answer
34 views

@PreAuthorize not working in spring security 6.1.3 in spring 3.1.3

I am facing a problem using Spring security @PreAuthorize annotation. I have followed many tutorials and theorically I am making everything right but for some reasons it doesn't work. All I wanted to ...
Luca Ferretti's user avatar
0 votes
1 answer
26 views

How to convert old spring boot 2 security configuration WebSecurityConfigurerAdapter based to new Spring boot 3 securityConfig

I have this spring boot 2 security class based on WebSecurityConfigurerAdapter import com.example.springsocial.security.*; import com.example.springsocial.security.oauth2.CustomOAuth2UserService; ...
Kris Swat's user avatar
  • 772
0 votes
1 answer
21 views

Spring Boot - Security/JPA - Insert to the database when getting a response from the handler

I want to insert a successful or failed login to the database depending on whether the user entered their credentials correctly or not. If the user enters their credentials incorrectly, the ...
Djorkaeff's user avatar
0 votes
0 answers
22 views

Spring Boot Filter called in anonymous request

Lil problem with Spring Security: I have two 'main-endpoints' in my app. /authenticated/** & /anonymous/**. The name of each endpoint is pretty much what I also want Spring Boot to do. ...
Z-100's user avatar
  • 518
0 votes
0 answers
40 views

How do I modify a response's ReadOnlyHttpHeaders in Spring WebFlux?

Recently I met some trouble things, this problem bothered me for a month, I don't know how to solve, online also can't find any relevant information, I'm going crazy. I didn't set the http header, it ...
Muscidae's user avatar
-1 votes
0 answers
39 views

Log in with postgres DBMS users in Spring Security

I have the following problem, I am developing a web application with spring boot, spring security and jdbc. I need that once the user clicks on the authenticate button in the login form, my ...
randyrh's user avatar
0 votes
2 answers
54 views

OAuth2 token introspection for each service request?

I've implemented a Spring based REST API (resource server) that uses the OAuth2 authorization code flow. The receives an opaque access token from the client and validated this token through a custom ...
eztam's user avatar
  • 3,475
2 votes
0 answers
84 views

ERR_TOO_MANY_REDIRECTS. State parameter not saved in database when oauth2 authorization server issues an authorization code to a client

I'm trying to replicate the oauth 2.0 authorization code flow with the following 3 projects, but, as you can see by the title, I'm struggling in getting redirected to the client server after I'm ...
lorenzoagainagaingain's user avatar
0 votes
0 answers
21 views

Updating from Spring Security 2.0 to Spring Security 3.2.9

I have updated my security-sso-beans.xml to the below code when migrating from Spring Security 2.0.2 to Spring Security 3.2.9. I am getting access denied error and JSON-error creating beans. Can you ...
user2859273's user avatar
1 vote
2 answers
29 views

My spring application does not start, it is giving an error in the class configuration even without having changed anything related to this

/usr/bin/env /usr/lib/jvm/jdk-17-oracle-x64/bin/java @/tmp/cp_4p3poytlo5gc9l704f0d0siz2.argfile com.lacertech.lacereats.LacerEatsAp plication . ____ _ __ _ _ /\\ / ___'_ __ ...
Italo Lacerda's user avatar
0 votes
0 answers
13 views

Spring security @PreFilter & @PostFilter for reactive methods

Is there an example of using @PostFilter ACL's in spring-security on a domain object say X , which is reactive ? For example, the method signature would be public Flux<X> repositoryMethod(). I ...
schengalath's user avatar
-2 votes
0 answers
13 views

Facing issue while updating the library of spring-boot-starter-parent class [closed]

Context : In order to mitigate the vulnerabilities for spring-security-web and spring-security-config we have updated the dependency version for spring-boot-starter-parent from 3.1.1 to 3.1.3 which is ...
nishant's user avatar
-1 votes
0 answers
25 views

When calling loadUserByUserName in springboot, arguments are not passed successfully

In spring security 3.1.2, the value in the json received from the client is correctly populated, but when I call loadUserByUsername it does not exceed this value, so the login request fails. I tried ...
Yongtae Park's user avatar
0 votes
0 answers
47 views

How to block endpoints by condition. AntMatchers does not recognize path variables

I have a Spring Boot application, with a property in the .properties file. I would like to be able to block/enable some endpoints based on condition. I've currently created two beans annotated with @...
Lako12's user avatar
  • 164
0 votes
1 answer
35 views

Spring security 6: override token validation (jwk-set-uri specific)

I need to integrate spring security with the oidm identity provider. The issue is that this idp has a GET type validation url that does not follow the standard. https://xxxxx.domain/oauth2/rest/token/...
François Poirier's user avatar
0 votes
1 answer
61 views

SPEL Injection Security concerns for using SPEL

We are planning to use SPEL in our SaaS based product to execute conditional expressions. My requirement is to use evaluate conditions where user can write conditional expressions using variables, ...
AdityaK01's user avatar
-1 votes
1 answer
41 views

Spring Security Login with static user dont work

I'm trying to implement a basic spring security login My security config class is this: package com.bookshelf2.demo; import org.springframework.context.annotation.Bean; import org.springframework....
Niccoló Balzarotti's user avatar
0 votes
1 answer
53 views

Multiple instances of Spring Authorization Server

I'm currently building a backend using Spring to build a backend and authenticating using Spring Authorization Server. After some trial and error, this is now working and authenticates the user with ...
CodeTheorist's user avatar
  • 1,430
-2 votes
1 answer
56 views

Updating to Spring Security 6.0 - failing unit tests after the replacing removed functionality [closed]

I'm trying to upgrade to Spring Boot 3.0.0 and Spring Security 6.0. The old version of the configuration file looks like this: import somecompany.verification.components.PreAuthFilter; import ...
Ivajlo Iliev's user avatar
-1 votes
0 answers
17 views

postFilter - alternative way of handling

I want to know is there a way to use a filter/interceptor to achieve the same what I am able to achieve using postFilter in the below sample code snippet. I want to add this postFilter in multiple ...
Guru's user avatar
  • 16.5k
0 votes
0 answers
40 views

How to stop too many redirects in springboot - react - google auth bundled app - securityconfig

I am stuck with too many redirects problem The initial example code I used is https://github.com/callicoder/spring-boot-react-oauth2-social-login-demo/tree/master The example app runs ok if spring and ...
Kris Swat's user avatar
  • 772
-1 votes
1 answer
53 views

Spring Boot - No SecurityContext found in WebSession

Currently I have a spring cloud gateway service and a number of other services. The gateway intercepts each request, checks if authorization is present and according allows/denies accessing a certain ...
omarsafwany's user avatar
  • 3,713
-2 votes
0 answers
13 views

Too Many Redirects - Spring Security Form Login [duplicate]

I'm getting too many redirects error. application.properties spring.mvc.view.prefix=/WEB-INF/jsp/ spring.mvc.view.suffix:.jsp MySecurityConfig.java @Configuration @EnableWebSecurity public class ...
Mradul Singhal's user avatar
0 votes
1 answer
53 views

Where to inject custom audit service in a spring boot application

I have a multi-module spring boot app, and every module has a dependency on an audit service (which is defined in a 'helper' module, only has a method called audit() and all it actually does is ...
martin's user avatar
  • 1
0 votes
0 answers
24 views

Error creating bean with name JwtUtill Requested Bean currently in creation mode [closed]

Error creating bean with name JwtUtill Requested Bean currently in creation mode is coming. Error is coming while launching spring boot app. I am try to implement JWT with Spring security. Whole code ...
Mehul Khanna's user avatar
-1 votes
0 answers
29 views

Spring security configuration for multiple APi's and multiple types of users

So, I am making this portal for bus reservation in which I have multiple modules and APIs but I am facing issues with spring security. So, I have one table for all types of users (admin and regular ...
asskayy's user avatar
  • 17

1
2 3 4 5
568