Questions tagged [spring-security]
Spring Security is the Spring Framework's application security solution. Spring Security can be used to secure URLs and method invocations. It is widely used to secure standalone web applications and REST APIs.
28,617
questions
0
votes
1
answer
26
views
Spring Security Role Based Authorization is not working
I'm implementing Spring Security in a demo Spring Boot project, I have implemented the following Spring Security Authorization for the URLs. But, I'm unable to access the GET APIs with the MANAGER and ...
0
votes
0
answers
20
views
Spring boot trusted Algo (RS256 , ES256 ) not working
I have a protected resource that can only be accessed using an OIDC access token. The authorization server signs this token using two algorithms (ES256 and RS256). When I call my resource server with ...
0
votes
1
answer
29
views
There is no client authentication. Try adding an appropriate authentication filter
I got error when I got token0
Handling error: InsufficientAuthenticationException, There is no client authentication. Try adding an appropriate authentication filter.
I can get the code from http://...
0
votes
1
answer
28
views
Securing an API whilst allowing access to Swagger [duplicate]
I have the following SecurintConfig:
@Configuration
public class SecurityConfig {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.csrf(csrf ...
0
votes
0
answers
9
views
Spring boot 6 + Angular CSRF throws 401 error, invalid csrf token
Spring security
@Configuration
public class SecurityConfiguration {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.csrf(c -> c....
-1
votes
0
answers
27
views
Spring Security ACL inhertiting on ACE level - alternatives
I am working with spring security.
I have the following simplified scenario:
class School{
@OneToMany
private Set<Module> modules;
}
class Module{
@ManyToOne
private School;
...
-1
votes
0
answers
34
views
localhost redirected you too many times with spring security [closed]
When i run my spring app,it's working without problem.But when i get localhost:8080 there is problem that .Firstly it worked without 42th line but now even it doesn't matter .It's not working.I added ...
0
votes
0
answers
13
views
What could be better alternatives way to handle authorization in spring cloud gateway according to my context?
Current Architecture:
We are using spring cloud gateway to act as application gateway to hide various applications and act as central point. These applications are varied, some are web servers, ...
-3
votes
0
answers
116
views
Spring rest controller configuration [closed]
Got a spring backend application. It doesn't handle requests. I got single controller:
@RestController
@RequestMapping("/api/login")
public class LoginContoller {
@PostMapping(produces = ...
0
votes
0
answers
21
views
Spring Security Fails to Validate SOAP Message Signature with Default Namespace Prefix
We have a Spring boot app that receives signed SOAP messages and have found that spring-security fails to verify the signature of the body if the envelope and body has a default namespace i.e. without ...
-2
votes
1
answer
156
views
Performing MatchableHandlerMapping lookup. it is logged once only at WARN level, and every time at TRACE
Cache miss for REQUEST dispatch to '/hello' (previous null). Performing MatchableHandlerMapping lookup. it is logged once only at WARN level, and every time at TRACE.
package com.springsec....
-2
votes
0
answers
22
views
fire the next filter when the current one fails in spring security filter chain [closed]
want to implement 2 authentication methods - basically try the 2nd one when the first one fails. is there a way to fire the next filter in the spring security filter chain when the previous one fails? ...
0
votes
1
answer
53
views
Moving SpringSecurityConfig to Spring Boot 3 [closed]
I've been struggling to map SecurityConfig file to the newer Spring version.
Specifically, the problem (I think) is caused by the UserDetailsService() or something related to it.
I'm trying to log in ...
-4
votes
0
answers
22
views
GitHub repo need to have integration of Spring cloud gateway+oAuth2 Authorization server+Resource Server+AbstractWebSecurityCongigurerAdopter [closed]
I want to implement a POC with Spring boot 2.0.x version and Finchley cloud dependencies with oAuth AuthorizationServer+ResourceServer+AbstractWebSecurityConfigAdopter with filter to validate access ...
-3
votes
1
answer
20
views
IDE is not recognizing the parseclaimsjws [closed]
mycode
Can someone help me please ?
i dont know what to do
static public Authentication obterAutenticacao(HttpServletRequest request){
String token = request.getHeader("Authorization&...
0
votes
0
answers
39
views
Changing role prefix in Spring Security 6
I am new to java and spring security. In spring security 6, lot of classes and interfaces have been deprecated.
I understand in Spring Security 6 we need to use AuthorizationManager however I am not ...
1
vote
0
answers
47
views
Spring Boot 3.2.0 Upgrade: "Authentication Manager Cannot Be Null" with RSocketSecurity
I recently upgraded my Spring Boot application to version 3.2.0 (along with Spring Framework 6.1.1 and Spring Security 6.2.0). Post-upgrade, I am encountering an issue where the contextLoads() test ...
-2
votes
0
answers
25
views
How to mitigate privilege escalation in Spring Boot Java using JWT tokens [closed]
If there are two types or roles - Admin and Normal user, when we copy the admin JWT token and paste it in the normal user token section in the browser, the normal user is being treated as admin with ...
-2
votes
0
answers
33
views
Consider defining a bean of type 'org.springframework.security.authentication.AuthenticationProvider' in your configuration
ERROR: Parameter 1 of constructor in com.example.Security.Config.SecurityConfig required a bean of type 'org.springframework.security.authentication.AuthenticationProvider' that could not be found.
`
...
-1
votes
1
answer
67
views
In Spring Security allowing some endpoints without authentication
I am working on spring security, I want some controller endpoints should need authentication, some should not. I have created one security config. and tried
@Bean
public SecurityConfigurerAdapter&...
-1
votes
0
answers
33
views
Passing more parameters to loadUserByUsername with Spring Boot 3 / Security 6
I'm trying to figure our how to pass more info to the loadUserByUsername(String username) function in my CustomUserDetailsService.
As far as I see, the username field from my login html view travels ...
-1
votes
0
answers
67
views
Upgrading to Spring Boot 3 broke my SQL query [closed]
I am upgrading an existing service to Spring Boot 3. This includes upgrading to spring-boot-starter-data-jpa 3.15 which means upgrading to Hibernate 6 and Tomcat 10.1. I am getting the error Invalid ...
1
vote
1
answer
47
views
Display warning that the redirect URI is invalid using the Spring Authorization server
I am using the Spring Authorization for OAuth2 and I want to display a warning to the user when the request to the /authorize endpoint has an invalid redirect uri i.e. uri that was not registered for ...
0
votes
1
answer
38
views
The problem with error 403 (Forbidden) before processing the request in Dispatcher Servlet Spring Security
I have a problem in my application using Spring Security. In case of any error, before the request gets to the Dispatcher Servlet, the error status 403 (Forbidden) is returned.
The problem occurs even ...
0
votes
0
answers
38
views
Spring Security 6(boot 3.2) downloading file via form in post request throws error null _csrf token
I just migrated my spring boot app to 3.2 from 2.7. Right now everything is working fine login, request which i make through axios as i am using vue js. But when i download file via form element using ...
0
votes
0
answers
42
views
JAVA/SPRING and ANGULAR authentication problem
I am currently working on an application in JAVA SPRING and ANGULAR. I am a novice and I am trying to progress in these two languages.
I am currently finishing the entire security part but there is ...
0
votes
0
answers
21
views
SpringBoot - How I can configure samesite none Csrf Cookie
What I have:
I have sprint boot api, and angular app in diferents domains (not subdomains), and is not an option change it.
I only grant access by cors to my angular domain app.
What I need:
I need ...
-3
votes
1
answer
50
views
Distinguish 401 (Unauthorized) / 403 (Forbidden) in Spring Security's AccessDeniedException in Global ExceptionHandler
I have Spring Security implemented in the Spring Boot application which, by default, will correctly throw 401 (Unauthorized) or 403 (Forbidden), such that the following unit tests work:
@Test
void ...
0
votes
1
answer
62
views
Spring Security 6 Authentication and Authorization with user in database [closed]
I have a project like platform for online food spring ordering system
I am using Hibernate with two Models like this:
@Entity
@Table(name = "users")
public class User {
@Id
@...
0
votes
0
answers
41
views
Vue + Spring boot,unable to get the authentication
The provided configuration works for Google, and I can obtain authentication in the sixth step, such as Name: [114139398535802188369], Granted Authorities, and so on. However, when using Facebook, I ...
-2
votes
0
answers
17
views
Is there a way to update user's Spring Security roles while they are logged in?
I have a Spring Boot / Spring MVC web application with Spring Security.
I have roles "ROLE_ADMIN" and "ROLE_READONLY".
UserA and User B both have "ROLE_ADMIN" (can do ...
0
votes
0
answers
9
views
Storing of the Session to redis
I have a problem regarding an old spring-security/JSF app from a client. It runs on tomcat and I need to store the session into redis.
My idea was to add redisson to the tomcat and store the http ...
-2
votes
2
answers
38
views
Should I move the Spring Security @PreAuthorize annotations to a new SecuredService class? [closed]
I have a Spring Boot / Spring MVC app with Spring Security.
I have an EntityService with methods:
@PreAuthorize("hasRole('VIEW')")
public Entity getEntity(id)
@PreAuthorize("hasRole('...
1
vote
0
answers
56
views
Spring security 401 when expecting 404 [duplicate]
In my spring security setup using Java 21 & SB 3.2, I've configured spring security to permit all requests matching "/hello/**"
This works when i'm accessing an existing endpoint, but ...
-3
votes
2
answers
52
views
Why am I getting 401 Unauthorized in my REST api when using permitAll() method in Spring Security? [closed]
Hello StackOverflow community. I am working on a Spring Boot 3 API which uses an http basic username and password login stored in a database. But when I post to the login url I got 401 unauthorized.
I ...
-2
votes
0
answers
40
views
what's wrong on this code, why page shows forbidden [closed]
what i correct on this to access page after login with google.
I am trying to make login with google using oauth2 but after login the user page can't accessed.
what can I do?
I'm trying to implement ...
-2
votes
0
answers
28
views
Spring Security endpoints access combine ResourceServerConfigurerAdapter and @PreAuthorize [closed]
I have a Spring Boot application with multiple controllers inside it. In those controllers I need to have a lot of public methods (which can be called for anyone without authorisation) and also some ...
0
votes
0
answers
25
views
Securing multiple Spring Boot APIs [closed]
I am struggling to understand/decide the best way to secure APIs in my Spring Boot application. I have a bunch of services, up to 10, several of which communicate with each other and others directly ...
-1
votes
2
answers
73
views
how to set CORS in spring boot? [duplicate]
I have react app on localhost:3000 and trying to make axios request in spring boot localhost:8080. I am using spring boot security, and enabled the cors() on httpFilter and then add annotation of @...
0
votes
1
answer
1k
views
CORS configuration with Spring Security and Vue.js
I created a Vue-Spring login API, which looks correct.
AuthForm.vue
methods: {
try_auth() {
if (this.check()) {
axios.post('http://localhost:8080/api/login', {
params: {
...
0
votes
2
answers
142
views
Spring Security 6 - Use JWT Tokens instead of JSESSIONID after OAuth2 Login
I've seen a couple of posts talking about something similar, though not exactly like what I'm trying to do. Namely I came across https://www.jessym.com/articles/stateless-oauth2-social-logins-with-...
0
votes
1
answer
55
views
Spring Security .hasAnyRole doesn't work, 403 Forbidden
@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
public class SecurityConfiguration {
private final JwtAuthenticationFilter jwtAuthFilter;
private final AuthenticationProvider ...
-1
votes
2
answers
77
views
Error processing condition on org.springframework.boot.autoconfigure.context.PropertyPlaceholderAutoConfiguration and "ClassNotFoundException: javax
1)When executing this error ouccred and searched and tried every solution given but any of them did work and i didnt know why. Here is my pom file :
4.0.0
org.springframework.boot
spring-boot-...
-3
votes
0
answers
44
views
Spring Boot Security 3.0 403 Forbidden problems [closed]
I made a program using Spring Scutiry 3.0, my codes are as follows.
My Security Configuration
`@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class GatewaySecurityConfig {
...
0
votes
0
answers
22
views
OAuth2.0 Flutter serverAuthCode to get Access Token at Spring backend server
I'm struggling with the OAuth google login process.
I can get the serverAuthCode using google_sign_in at my Flutter app.
then I want to get Access Token.
But I think send Access Token from Flutter to ...
0
votes
1
answer
51
views
ERROR: No primary or single unique constructor found for interface com.springdemo.springApplication.Service.Coach
I am new to Spring Boot. Getting Error in Dependency Injection. Here are the classes.
DemoRestController
package com.springdemo.springApplication.Rest;
import com.springdemo.springApplication.Service....
0
votes
0
answers
31
views
Secure Spring Boot / Vaadin web-interface with rest api
I made an app with Spring Boot and Vaadin which provides rest functionality for mobile devices.
Currently the api-requests are secured by an Auth-Token and I want to use the security features for the ...
-3
votes
0
answers
49
views
Java-Spring framework levels and the highest level examples you can develop [closed]
I'm learning the Spring framework and would like an idea of how far I can get. Which issues are covered at the highest level and in what detail?
All the subjects I have learned so far : Hibernate, JPA,...
0
votes
1
answer
55
views
Spring Security OAuth2 Generic Configuration
I am trying to setup a spring security (v5.8.8) configuration to connect to different OAuth2 authorization servers. I am testing with Azure and Okta. I would prefer to only use Spring Security without ...
0
votes
0
answers
26
views
Using SpringSecurity with a non-compliant OAuth provider (Clerk.com)
I'm having trouble using SpringSecurity with a non-compliant OAuth provider (Clerk.com). When I use Spring Security with a default configuration, it complains that it's "Missing JSON object ...