spring-security

Spring Boot CORS filter – CORS preflight channel did not succeed

by

I have fixed this issue by creating a new CORS Filter: @Component public class CorsFilter extends OncePerRequestFilter { @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { response.setHeader(“Access-Control-Allow-Origin”, “*”); response.setHeader(“Access-Control-Allow-Methods”, “GET, POST, PUT, DELETE, OPTIONS”); response.setHeader(“Access-Control-Max-Age”, “3600”); response.setHeader(“Access-Control-Allow-Headers”, “authorization, content-type, xsrf-token”); response.addHeader(“Access-Control-Expose-Headers”, “xsrf-token”); if (“OPTIONS”.equals(request.getMethod())) { response.setStatus(HttpServletResponse.SC_OK); } else { filterChain.doFilter(request, … Read more

Spring Security – Token based API auth & user/password authentication

by

I believe the error that you mention is just because the AbstractAuthenticationProcessingFilter base class that you are using requires an AuthenticationManager. If you aren’t going to use it you can set it to a no-op, or just implement Filter directly. If your Filter can authenticate the request and sets up the SecurityContext then usually the … Read more

Calling static methods from Spring Security Expressions?

by

By using the T(fully.qualified.name).methodName() syntax: You can use the special T operator to specify an instance of java.lang.Class (the type). Static methods are invoked by using this operator as well. The StandardEvaluationContext uses a TypeLocator to find types, and the StandardTypeLocator (which can be replaced) is built with an understanding of the java.lang package. This … Read more

Could not verify the provided CSRF token because your session was not found in spring security

by

According to spring.io: When should you use CSRF protection? Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-browser clients, you will likely want to disable CSRF protection. So to disable it: @Configuration … Read more

Spring security vs Apache Shiro [duplicate]

by

Many of the Shiro developers use Spring for their applications, so Shiro works beautifully in Spring environments. The general feedback we’ve received thus far is that Shiro is also far easier to understand (for most people) than Spring Security. If you want full Session clustering support across any web container however, only Shiro will support … Read more

“Cannot resolve method” with mockito

by

Try using the other syntax to return your collection with a wildcard matching generic: doReturn(grantedAuthorities).when(authentication).getAuthorities(); This doReturn call isn’t type-safe and results in a runtime check on type but for your purposes it will return the mocked list you want. There are a lot of details using mockito and generics with wildcards. For more details: … Read more

How to use for checking multiple Roles?

by

There is a special security expression in spring security: hasAnyRole(list of roles) – true if the user has been granted any of the roles specified (given as a comma-separated list of strings). I have never used it but I think it is exactly what you are looking for. Example usage: <security:authorize access=”hasAnyRole(‘ADMIN’, ‘DEVELOPER’)”> … </security:authorize> … Read more

Return HTTP Error 401 Code & Skip Filter Chains

by

I suggest this solution below. public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) req; final String val = request.getHeader(FOO_TOKEN) if (val == null || !val.equals(“FOO”)) { ((HttpServletResponse) response).sendError(HttpServletResponse.SC_UNAUTHORIZED, “The token is not valid.”); } else { chain.doFilter(req, res); } }