Questions tagged [spring-security]

Spring Security is the Spring Framework's application security solution. Spring Security can be used to secure URLs and method invocations. It is widely used to secure standalone web applications and REST APIs.

Filter by
Sorted by
Tagged with
0 votes
1 answer
26 views

Spring Security Role Based Authorization is not working

I'm implementing Spring Security in a demo Spring Boot project, I have implemented the following Spring Security Authorization for the URLs. But, I'm unable to access the GET APIs with the MANAGER and ...
Abhishek Satyavolu's user avatar
0 votes
0 answers
20 views

Spring boot trusted Algo (RS256 , ES256 ) not working

I have a protected resource that can only be accessed using an OIDC access token. The authorization server signs this token using two algorithms (ES256 and RS256). When I call my resource server with ...
someRandomGuy's user avatar
0 votes
1 answer
29 views

There is no client authentication. Try adding an appropriate authentication filter

I got error when I got token0 Handling error: InsufficientAuthenticationException, There is no client authentication. Try adding an appropriate authentication filter. I can get the code from http://...
jason li's user avatar
0 votes
1 answer
28 views

Securing an API whilst allowing access to Swagger [duplicate]

I have the following SecurintConfig: @Configuration public class SecurityConfig { @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.csrf(csrf ...
skyman's user avatar
  • 2,255
0 votes
0 answers
9 views

Spring boot 6 + Angular CSRF throws 401 error, invalid csrf token

Spring security @Configuration public class SecurityConfiguration { @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.csrf(c -> c....
Kimin Lee's user avatar
-1 votes
0 answers
27 views

Spring Security ACL inhertiting on ACE level - alternatives

I am working with spring security. I have the following simplified scenario: class School{ @OneToMany private Set<Module> modules; } class Module{ @ManyToOne private School; ...
openGLisLife's user avatar
-1 votes
0 answers
34 views

localhost redirected you too many times with spring security [closed]

When i run my spring app,it's working without problem.But when i get localhost:8080 there is problem that .Firstly it worked without 42th line but now even it doesn't matter .It's not working.I added ...
Terlan İbrahimli's user avatar
0 votes
0 answers
13 views

What could be better alternatives way to handle authorization in spring cloud gateway according to my context?

Current Architecture: We are using spring cloud gateway to act as application gateway to hide various applications and act as central point. These applications are varied, some are web servers, ...
jacksparrow777's user avatar
-3 votes
0 answers
116 views

Spring rest controller configuration [closed]

Got a spring backend application. It doesn't handle requests. I got single controller: @RestController @RequestMapping("/api/login") public class LoginContoller { @PostMapping(produces = ...
MC_Vovi's user avatar
  • 11
0 votes
0 answers
21 views

Spring Security Fails to Validate SOAP Message Signature with Default Namespace Prefix

We have a Spring boot app that receives signed SOAP messages and have found that spring-security fails to verify the signature of the body if the envelope and body has a default namespace i.e. without ...
Ted Lundqvist's user avatar
-2 votes
1 answer
156 views

Performing MatchableHandlerMapping lookup. it is logged once only at WARN level, and every time at TRACE

Cache miss for REQUEST dispatch to '/hello' (previous null). Performing MatchableHandlerMapping lookup. it is logged once only at WARN level, and every time at TRACE. package com.springsec....
Nishanth M's user avatar
-2 votes
0 answers
22 views

fire the next filter when the current one fails in spring security filter chain [closed]

want to implement 2 authentication methods - basically try the 2nd one when the first one fails. is there a way to fire the next filter in the spring security filter chain when the previous one fails? ...
Joseph's user avatar
  • 93
0 votes
1 answer
53 views

Moving SpringSecurityConfig to Spring Boot 3 [closed]

I've been struggling to map SecurityConfig file to the newer Spring version. Specifically, the problem (I think) is caused by the UserDetailsService() or something related to it. I'm trying to log in ...
Shekel Sniffer's user avatar
-4 votes
0 answers
22 views

GitHub repo need to have integration of Spring cloud gateway+oAuth2 Authorization server+Resource Server+AbstractWebSecurityCongigurerAdopter [closed]

I want to implement a POC with Spring boot 2.0.x version and Finchley cloud dependencies with oAuth AuthorizationServer+ResourceServer+AbstractWebSecurityConfigAdopter with filter to validate access ...
PurnaChandu Sapparapu's user avatar
-3 votes
1 answer
20 views

IDE is not recognizing the parseclaimsjws [closed]

mycode Can someone help me please ? i dont know what to do static public Authentication obterAutenticacao(HttpServletRequest request){ String token = request.getHeader("Authorization&...
JoaoTamassia's user avatar
0 votes
0 answers
39 views

Changing role prefix in Spring Security 6

I am new to java and spring security. In spring security 6, lot of classes and interfaces have been deprecated. I understand in Spring Security 6 we need to use AuthorizationManager however I am not ...
Sachin Brar's user avatar
1 vote
0 answers
47 views

Spring Boot 3.2.0 Upgrade: "Authentication Manager Cannot Be Null" with RSocketSecurity

I recently upgraded my Spring Boot application to version 3.2.0 (along with Spring Framework 6.1.1 and Spring Security 6.2.0). Post-upgrade, I am encountering an issue where the contextLoads() test ...
ASD's user avatar
  • 11
-2 votes
0 answers
25 views

How to mitigate privilege escalation in Spring Boot Java using JWT tokens [closed]

If there are two types or roles - Admin and Normal user, when we copy the admin JWT token and paste it in the normal user token section in the browser, the normal user is being treated as admin with ...
Shiva kumar's user avatar
-2 votes
0 answers
33 views

Consider defining a bean of type 'org.springframework.security.authentication.AuthenticationProvider' in your configuration

ERROR: Parameter 1 of constructor in com.example.Security.Config.SecurityConfig required a bean of type 'org.springframework.security.authentication.AuthenticationProvider' that could not be found. ` ...
Gagan's user avatar
  • 1
-1 votes
1 answer
67 views

In Spring Security allowing some endpoints without authentication

I am working on spring security, I want some controller endpoints should need authentication, some should not. I have created one security config. and tried @Bean public SecurityConfigurerAdapter&...
Saurav's user avatar
  • 11
-1 votes
0 answers
33 views

Passing more parameters to loadUserByUsername with Spring Boot 3 / Security 6

I'm trying to figure our how to pass more info to the loadUserByUsername(String username) function in my CustomUserDetailsService. As far as I see, the username field from my login html view travels ...
Deses's user avatar
  • 1,090
-1 votes
0 answers
67 views

Upgrading to Spring Boot 3 broke my SQL query [closed]

I am upgrading an existing service to Spring Boot 3. This includes upgrading to spring-boot-starter-data-jpa 3.15 which means upgrading to Hibernate 6 and Tomcat 10.1. I am getting the error Invalid ...
ponder275's user avatar
  • 913
1 vote
1 answer
47 views

Display warning that the redirect URI is invalid using the Spring Authorization server

I am using the Spring Authorization for OAuth2 and I want to display a warning to the user when the request to the /authorize endpoint has an invalid redirect uri i.e. uri that was not registered for ...
Axo's user avatar
  • 11
0 votes
1 answer
38 views

The problem with error 403 (Forbidden) before processing the request in Dispatcher Servlet Spring Security

I have a problem in my application using Spring Security. In case of any error, before the request gets to the Dispatcher Servlet, the error status 403 (Forbidden) is returned. The problem occurs even ...
KripDo's user avatar
  • 79
0 votes
0 answers
38 views

Spring Security 6(boot 3.2) downloading file via form in post request throws error null _csrf token

I just migrated my spring boot app to 3.2 from 2.7. Right now everything is working fine login, request which i make through axios as i am using vue js. But when i download file via form element using ...
aakash singh's user avatar
0 votes
0 answers
42 views

JAVA/SPRING and ANGULAR authentication problem

I am currently working on an application in JAVA SPRING and ANGULAR. I am a novice and I am trying to progress in these two languages. I am currently finishing the entire security part but there is ...
GotaKev's user avatar
  • 45
0 votes
0 answers
21 views

SpringBoot - How I can configure samesite none Csrf Cookie

What I have: I have sprint boot api, and angular app in diferents domains (not subdomains), and is not an option change it. I only grant access by cors to my angular domain app. What I need: I need ...
David Burgos's user avatar
-3 votes
1 answer
50 views

Distinguish 401 (Unauthorized) / 403 (Forbidden) in Spring Security's AccessDeniedException in Global ExceptionHandler

I have Spring Security implemented in the Spring Boot application which, by default, will correctly throw 401 (Unauthorized) or 403 (Forbidden), such that the following unit tests work: @Test void ...
gene b.'s user avatar
  • 10.9k
0 votes
1 answer
62 views

Spring Security 6 Authentication and Authorization with user in database [closed]

I have a project like platform for online food spring ordering system I am using Hibernate with two Models like this: @Entity @Table(name = "users") public class User { @Id @...
Đào Kim Dương's user avatar
0 votes
0 answers
41 views

Vue + Spring boot,unable to get the authentication

The provided configuration works for Google, and I can obtain authentication in the sixth step, such as Name: [114139398535802188369], Granted Authorities, and so on. However, when using Facebook, I ...
陳冠諭's user avatar
-2 votes
0 answers
17 views

Is there a way to update user's Spring Security roles while they are logged in?

I have a Spring Boot / Spring MVC web application with Spring Security. I have roles "ROLE_ADMIN" and "ROLE_READONLY". UserA and User B both have "ROLE_ADMIN" (can do ...
AvaTaylor's user avatar
  • 645
0 votes
0 answers
9 views

Storing of the Session to redis

I have a problem regarding an old spring-security/JSF app from a client. It runs on tomcat and I need to store the session into redis. My idea was to add redisson to the tomcat and store the http ...
noircc's user avatar
  • 642
-2 votes
2 answers
38 views

Should I move the Spring Security @PreAuthorize annotations to a new SecuredService class? [closed]

I have a Spring Boot / Spring MVC app with Spring Security. I have an EntityService with methods: @PreAuthorize("hasRole('VIEW')") public Entity getEntity(id) @PreAuthorize("hasRole('...
AvaTaylor's user avatar
  • 645
1 vote
0 answers
56 views

Spring security 401 when expecting 404 [duplicate]

In my spring security setup using Java 21 & SB 3.2, I've configured spring security to permit all requests matching "/hello/**" This works when i'm accessing an existing endpoint, but ...
Phi Tiet's user avatar
-3 votes
2 answers
52 views

Why am I getting 401 Unauthorized in my REST api when using permitAll() method in Spring Security? [closed]

Hello StackOverflow community. I am working on a Spring Boot 3 API which uses an http basic username and password login stored in a database. But when I post to the login url I got 401 unauthorized. I ...
Lorena's user avatar
  • 15
-2 votes
0 answers
40 views

what's wrong on this code, why page shows forbidden [closed]

what i correct on this to access page after login with google. I am trying to make login with google using oauth2 but after login the user page can't accessed. what can I do? I'm trying to implement ...
Nomit Singh's user avatar
-2 votes
0 answers
28 views

Spring Security endpoints access combine ResourceServerConfigurerAdapter and @PreAuthorize [closed]

I have a Spring Boot application with multiple controllers inside it. In those controllers I need to have a lot of public methods (which can be called for anyone without authorisation) and also some ...
zzzzz's user avatar
  • 216
0 votes
0 answers
25 views

Securing multiple Spring Boot APIs [closed]

I am struggling to understand/decide the best way to secure APIs in my Spring Boot application. I have a bunch of services, up to 10, several of which communicate with each other and others directly ...
skyman's user avatar
  • 2,255
-1 votes
2 answers
73 views

how to set CORS in spring boot? [duplicate]

I have react app on localhost:3000 and trying to make axios request in spring boot localhost:8080. I am using spring boot security, and enabled the cors() on httpFilter and then add annotation of @...
milanHrabos's user avatar
  • 2,071
0 votes
1 answer
1k views

CORS configuration with Spring Security and Vue.js

I created a Vue-Spring login API, which looks correct. AuthForm.vue methods: { try_auth() { if (this.check()) { axios.post('http://localhost:8080/api/login', { params: { ...
MC_Vovi's user avatar
  • 11
0 votes
2 answers
142 views

Spring Security 6 - Use JWT Tokens instead of JSESSIONID after OAuth2 Login

I've seen a couple of posts talking about something similar, though not exactly like what I'm trying to do. Namely I came across https://www.jessym.com/articles/stateless-oauth2-social-logins-with-...
HaedHutner's user avatar
0 votes
1 answer
55 views

Spring Security .hasAnyRole doesn't work, 403 Forbidden

@Configuration @EnableWebSecurity @RequiredArgsConstructor public class SecurityConfiguration { private final JwtAuthenticationFilter jwtAuthFilter; private final AuthenticationProvider ...
Lucas Dechaumet's user avatar
-1 votes
2 answers
77 views

Error processing condition on org.springframework.boot.autoconfigure.context.PropertyPlaceholderAutoConfiguration and "ClassNotFoundException: javax

1)When executing this error ouccred and searched and tried every solution given but any of them did work and i didnt know why. Here is my pom file : 4.0.0 org.springframework.boot spring-boot-...
Giuseppe's user avatar
-3 votes
0 answers
44 views

Spring Boot Security 3.0 403 Forbidden problems [closed]

I made a program using Spring Scutiry 3.0, my codes are as follows. My Security Configuration `@Configuration @EnableWebSecurity @EnableMethodSecurity public class GatewaySecurityConfig { ...
mark's user avatar
  • 1
0 votes
0 answers
22 views

OAuth2.0 Flutter serverAuthCode to get Access Token at Spring backend server

I'm struggling with the OAuth google login process. I can get the serverAuthCode using google_sign_in at my Flutter app. then I want to get Access Token. But I think send Access Token from Flutter to ...
노제원's user avatar
0 votes
1 answer
51 views

ERROR: No primary or single unique constructor found for interface com.springdemo.springApplication.Service.Coach

I am new to Spring Boot. Getting Error in Dependency Injection. Here are the classes. DemoRestController package com.springdemo.springApplication.Rest; import com.springdemo.springApplication.Service....
swapnil bhatia's user avatar
0 votes
0 answers
31 views

Secure Spring Boot / Vaadin web-interface with rest api

I made an app with Spring Boot and Vaadin which provides rest functionality for mobile devices. Currently the api-requests are secured by an Auth-Token and I want to use the security features for the ...
Martin Pfeffer's user avatar
-3 votes
0 answers
49 views

Java-Spring framework levels and the highest level examples you can develop [closed]

I'm learning the Spring framework and would like an idea of how far I can get. Which issues are covered at the highest level and in what detail? All the subjects I have learned so far : Hibernate, JPA,...
lmamBayildi's user avatar
0 votes
1 answer
55 views

Spring Security OAuth2 Generic Configuration

I am trying to setup a spring security (v5.8.8) configuration to connect to different OAuth2 authorization servers. I am testing with Azure and Okta. I would prefer to only use Spring Security without ...
Mike Rother's user avatar
0 votes
0 answers
26 views

Using SpringSecurity with a non-compliant OAuth provider (Clerk.com)

I'm having trouble using SpringSecurity with a non-compliant OAuth provider (Clerk.com). When I use Spring Security with a default configuration, it complains that it's "Missing JSON object ...
Shmuel Newmark's user avatar

1
2 3 4 5
573