Spring security: My Authorization filter authorizes my request even tho the URL is permited

In my security configuration class i have permitted the request to the welcome url and any other url which follows the "welcome/**" format.

this is my securityconfiguration class:

@EnableGlobalMethodSecurity(prePostEnabled = true)
//@Configuration
@EnableWebSecurity
public class JwtSecurityConfiguration extends WebSecurityConfigurerAdapter


@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception
return super.authenticationManagerBean();



private final CustomerDetailsService customerDetailsService;

@Autowired
private JwtAuthenticationEntryPoint unauthorizedHandler;

@Autowired
public JwtSecurityConfiguration(CustomerDetailsService customerDetailsService)

this.customerDetailsService = customerDetailsService;



@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception
auth
.userDetailsService(customerDetailsService)
.passwordEncoder(passwordEncoderBean());


@Bean
public PasswordEncoder passwordEncoderBean()
return new BCryptPasswordEncoder();




@Override
public void configure(WebSecurity web) throws Exception

web.ignoring().antMatchers("**/resources/static/**")
.and()
.ignoring()
.antMatchers(
HttpMethod.GET,
"/",
"/*.html",
"/favicon.ico",
"/**/*.html",
"/**/*.css",
"/**/*.js",
"/index_assets/**"
);


@Override
protected void configure(HttpSecurity http) throws Exception

http.csrf().disable()
.authorizeRequests()
.antMatchers("/welcome/login").permitAll()
.antMatchers("/welcome").permitAll()
.antMatchers("/welcome/signup").permitAll()
.antMatchers("admin/rest/**").authenticated()
.and()
.exceptionHandling().authenticationEntryPoint(unauthorizedHandler)
.and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

//http.addFilterBefore(new JWTAuthenticationFilter(authenticationManager()), UsernamePasswordAuthenticationFilter.class);

http.addFilterBefore(new JWTAuthorizationFilter(authenticationManager(),customerDetailsService),UsernamePasswordAuthenticationFilter.class);

// disable page caching
http
.headers()
.frameOptions().sameOrigin() // required to set for H2 else H2 Console will be blank.
.cacheControl();

//http.headers().cacheControl();





but I noticed that in my JWTAuthorizationFilter.class the doFilterInternal() method picks up this URL

public class JWTAuthorizationFilter extends OncePerRequestFilter

private final CustomerDetailsService customerDetailsService;

@Autowired
DefaultCookieService defaultCookieService;


public JWTAuthorizationFilter(AuthenticationManager authenticationManager, CustomerDetailsService customerDetailsService)

// super(authenticationManager);

this.customerDetailsService = customerDetailsService;


@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException

private UsernamePasswordAuthenticationToken getAuthenticationToken(HttpServletRequest request)

String token = request.getHeader(HEADER);

if(Objects.isNull(token)) return null;

String username = Jwts.parser().setSigningKey(SECRET)
.parseClaimsJws(token.replace(TOKEN_PREFIX,""))
.getBody()
.getSubject();


UserDetails userDetails = customerDetailsService.loadUserByUsername(username);

return username != null ? new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities()) : null;




What is the cause of this ?

1 Answer
1

Filter is suppose to pick up each and every request. It doesn't matter if that you have permitted or not in security configuration.

You have got two options:

If you don't want welcome/** to go through the filter you add it to web ignore

welcome/**

@Override
public void configure(WebSecurity web) throws Exception

web.ignoring().antMatchers("**/resources/static/**")
.and()
.ignoring()
.antMatchers(
HttpMethod.GET,
"/",
"/*.html",
"/favicon.ico",
"/**/*.html",
"/**/*.css",
"/**/*.js",
"/index_assets/**",
"/welcome/**"
);



But note, it will skip all filters and you may not want that.

doFilterInternal

welcome/**

.permitAll()

JWTAuthorizationFilter

UsernamePasswordAuthenticationFilter

@EnableWebSecurity(debug = true)

Thanks for contributing an answer to Stack Overflow!

But avoid …

To learn more, see our tips on writing great answers.

Required, but never shown

Required, but never shown

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.