Spring Boot JS App wont work after securing rest-api with Spring Security

1
votes

I created a simple Spring Boot/ JS App. In a next step I tried to implement an usermanagement feature to handle multiple users.

So I implemented a usermodel and controller and secured all rest-api calls via authentication of spring security.

@Configuration
@EnableWebSecurity
@ComponentScan("package.packagename")
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
DataSource dataSource;
@Autowired
public void configAuthentication(AuthenticationManagerBuilder auth) throws Exception{

    auth.jdbcAuthentication().dataSource(dataSource)
            .usersByUsernameQuery("select email, password, active from accounts where email=?")
            .authoritiesByUsernameQuery("select email, role from account_roles where email=?");
}

@Override
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
protected void configure(HttpSecurity http) throws Exception {
        http
                .formLogin().permitAll()
                .and()
                .authorizeRequests()
                .antMatchers("/index.html",  "/").permitAll()
                .anyRequest().authenticated()
                .and()
                .logout();                    
    }
}

Additionally to this file I have the SecurityWebApplicationInitializer

public class SecurityWebApplicationInitializer
    extends AbstractSecurityWebApplicationInitializer {

public SecurityWebApplicationInitializer() {
    super(SecurityConfig.class);
}
}

My problem now is the fact, that if I start the application and try to access it via localhost:8080 I face an 404 Error. Usually the app should work even without login and it seems that with springsecurity enabled the app is not able to load the js stuff in resources/public directory.

Reading the logs showed the following:

No mapping found for HTTP request with URI [/] in DispatcherServlet with name 'dispatcherServlet'

If I start the App without spring security it works without any problems.

The securing of the api-calls works like a charm - I'm able to login, receive a cookie and use this cookie to authenticate against the api-functions which are secured by springsecurity.

I hope you can help me to resolve my (hopefully small) problem.

Thanks in advance

2
springspring-securityspring-boot

2 Answers

1
votes

When you use .formLogin() you need to define the login page or use .httpBasic() auth. So you can use something like this:

    .formLogin()                      
        .and()
    .httpBasic();

or 

    .formLogin()
        .loginPage("/login.html")

You can read more here

http://docs.spring.io/spring-security/site/docs/3.2.x/guides/form.html

http://www.baeldung.com/spring-security-login

0
votes

I figured out that I have to add a WebConfig.java class like this:

import org.springframework.boot.autoconfigure.web.WebMvcAutoConfiguration;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;

@Configuration
@EnableWebMvc
@ComponentScan
public class WebConfig extends WebMvcAutoConfiguration.WebMvcAutoConfigurationAdapter {

}

Now Spring is able to resolve the / call properly. I just have to make sure to open the access to all files in public for all users (permitall() function).

Anyway thanks for your help :-)