Have you tried using SessionCreationPolicy.STATELESS. There is a subtle difference between STATELESS and NEVER in the spring docs: STATELESS: Spring Security will never create an HttpSession and it will never use it to obtain the SecurityContext. NEVER: Spring Security will never create an HttpSession, but will use the HttpSession if it already exists. So I … Read more
If you don’t want login page (from Spring-Security) remove the following dependency from your pom.xml and do maven update to refresh the dependencies on the class path. <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency> Or if you want to use the Spring-Security then on console it will display the default password like below : Using default security password: … Read more
You can specify as many providers as you want. They will be checked in the same order you declared them inside the authentication-manager tag. Once a successful authentication is made, it will stop polling the providers. If any provider throws an AccountStatusException it will also break the polling.
If you haven’t actually registered any users with your existing format then you would be best to switch to using the BCrypt password encoder instead. It’s a lot less hassle, as you don’t have to worry about salt at all – the details are completely encapsulated within the encoder. Using BCrypt is stronger than using … Read more
According to the new updates in Spring 2.0, if Spring Security is on the classpath, Spring Boot will add @EnableWebSecurity.So adding entries to the application.properties ain’t gonna work (i.e it is no longer customizable that way). For more information visit the official website Security changes in Spring Boot 2.0 Albeit not sure about your requirement … Read more
I guess MODE_INHERITABLETHREADLOCAL doesn’t work correctly with thread pool. As a possible solution you can try to subclass ThreadPoolTaskExecutor and override its methods to propagate SecurityContext manually, and then declare that executor instead of <task:executor>, something like this: public void execute(final Runnable r) { final Authentication a = SecurityContextHolder.getContext().getAuthentication(); super.execute(new Runnable() { public void run() … Read more
What is the real-life reason to disable it? The Spring documentation suggests: Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-browser clients, you will likely want to disable CSRF protection. Does it … Read more
Found the solution in Spring security examples posted in Github. WebSecurityConfigurerAdapter has a overloaded configure message that takes WebSecurity as argument which accepts ant matchers on requests to be ignored. @Override public void configure(WebSecurity web) throws Exception { web.ignoring().antMatchers(“/authFailure”); } See Spring Security Samples for more details
OAuth 2.0 Client features of Spring Security 5.2.x do not support RestTemplate, but only WebClient. See Spring Security Reference: HTTP Client support WebClient integration for Servlet Environments (for requesting protected resources) In addition, RestTemplate will be deprecated in a future version. See RestTemplate javadoc: NOTE: As of 5.0, the non-blocking, reactive org.springframework.web.reactive.client.WebClient offers a modern … Read more
Since Spring Security 4.1, this is the proper way to make Spring Security support CORS (also needed in Spring Boot 1.4/1.5): @Configuration public class WebConfig extends WebMvcConfigurerAdapter { @Override public void addCorsMappings(CorsRegistry registry) { registry.addMapping(“/**”) .allowedMethods(“HEAD”, “GET”, “PUT”, “POST”, “DELETE”, “PATCH”); } } and: @Configuration public class SecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity … Read more