In a previous question of mine I was informed of the DelegatingAuthenticationEntryPoint class.
However, I'm having an issue where spring isn't returning the correct Http response status.
Here's my overridden configure method
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable();
LinkedHashMap<RequestMatcher, AuthenticationEntryPoint> map = new LinkedHashMap<>();
map.put(new AntPathRequestMatcher(WELCOME_PAGE), new Http403ForbiddenEntryPoint());
map.put(new AntPathRequestMatcher(FOOD_SELECTION_PAGE + "/**"), new Http403ForbiddenEntryPoint());
map.put(new AntPathRequestMatcher(CHECKOUT_URL), new Http403ForbiddenEntryPoint());
map.put(new AntPathRequestMatcher(VERIFY_BADGE_URL), new Http403ForbiddenEntryPoint());
map.put(new AntPathRequestMatcher(VERIFY_NAME_URL), new Http403ForbiddenEntryPoint());
map.put(new AntPathRequestMatcher(ADMIN_PAGE), new LoginUrlAuthenticationEntryPoint(LOGIN_PAGE));
map.put(new AntPathRequestMatcher(NEW_FOOD_PAGE), new LoginUrlAuthenticationEntryPoint(LOGIN_PAGE));
map.put(new AntPathRequestMatcher(EDIT_FOOD_URL + "/**"), new LoginUrlAuthenticationEntryPoint(LOGIN_PAGE));
map.put(new AntPathRequestMatcher(HIDE_FOOD_URL), new Http403ForbiddenEntryPoint());
map.put(new AntPathRequestMatcher(SHOW_FOOD_URL), new Http403ForbiddenEntryPoint());
map.put(new AntPathRequestMatcher(DELETE_FOOD_URL), new Http403ForbiddenEntryPoint());
map.put(new AntPathRequestMatcher(REFRESH_EMPS_URL), new Http403ForbiddenEntryPoint());
http.authorizeRequests()
.antMatchers(WELCOME_PAGE,
FOOD_SELECTION_PAGE + "/**",
CHECKOUT_URL,
VERIFY_BADGE_URL,
VERIFY_NAME_URL).denyAll()
.antMatchers(ADMIN_PAGE,
NEW_FOOD_PAGE,
EDIT_FOOD_URL + "/**",
HIDE_FOOD_URL,
SHOW_FOOD_URL,
DELETE_FOOD_URL,
REFRESH_EMPS_URL).hasAnyAuthority("ROLES_USER")
.anyRequest().permitAll()
.and().formLogin().loginPage(LOGIN_PAGE)
.usernameParameter("username")
.passwordParameter("pin")
.defaultSuccessUrl(ADMIN_PAGE)
.permitAll()
.failureUrl(LOGIN_PAGE + "?badlogin")
.and().exceptionHandling().authenticationEntryPoint(new DelegatingAuthenticationEntryPoint(map));
}
I'm using postman to execute a post request to the VERIFY_BADGE_URL. The DelegatingAuthenticationEntryPoint is correctly mapping this request to the Http403ForbiddenEntryPoint as seen in these logs
2021-08-18 10:18:57,879 DEBUG [https-jsse-nio-8443-exec-5] org.springframework.security.web.authentication.DelegatingAuthenticationEntryPoint: Match found! Executing org.springframework.security.web.authentication.Http403ForbiddenEntryPoint@8f8351a
2021-08-18 10:18:57,879 DEBUG [https-jsse-nio-8443-exec-5] org.springframework.security.web.authentication.Http403ForbiddenEntryPoint: Pre-authenticated entry point called. Rejecting access
Then upon further processing, I notice that it eventually gets converted to a 405 status and is returned back to postman as such as seen in these logs.
2021-08-18 10:18:57,880 DEBUG [https-jsse-nio-8443-exec-5] org.springframework.security.web.context.HttpSessionSecurityContextRepository$SaveToSessionResponseWrapper: Did not store empty SecurityContext
2021-08-18 10:18:57,881 DEBUG [https-jsse-nio-8443-exec-5] org.springframework.security.web.context.HttpSessionSecurityContextRepository$SaveToSessionResponseWrapper: Did not store empty SecurityContext
2021-08-18 10:18:57,881 DEBUG [https-jsse-nio-8443-exec-5] org.springframework.security.web.context.SecurityContextPersistenceFilter: Cleared SecurityContextHolder to complete request
2021-08-18 10:18:57,881 DEBUG [https-jsse-nio-8443-exec-5] org.apache.juli.logging.DirectJDKLog: Processing ErrorPage[errorCode=0, location=/error]
2021-08-18 10:18:57,884 DEBUG [https-jsse-nio-8443-exec-5] org.springframework.security.web.FilterChainProxy: Securing POST /error
2021-08-18 10:18:57,884 DEBUG [https-jsse-nio-8443-exec-5] org.springframework.security.web.context.SecurityContextPersistenceFilter: Set SecurityContextHolder to empty SecurityContext
2021-08-18 10:18:57,884 DEBUG [https-jsse-nio-8443-exec-5] org.springframework.security.web.authentication.AnonymousAuthenticationFilter: Set SecurityContextHolder to anonymous SecurityContext
2021-08-18 10:18:57,884 DEBUG [https-jsse-nio-8443-exec-5] org.springframework.security.web.FilterChainProxy$VirtualFilterChain: Secured POST /error
2021-08-18 10:18:57,886 DEBUG [https-jsse-nio-8443-exec-5] org.springframework.core.log.LogFormatUtils: "ERROR" dispatch for POST "/error", parameters={}
2021-08-18 10:18:57,889 DEBUG [https-jsse-nio-8443-exec-5] org.springframework.security.web.context.HttpSessionSecurityContextRepository$SaveToSessionResponseWrapper: Did not store anonymous SecurityContext
2021-08-18 10:18:57,889 WARN [https-jsse-nio-8443-exec-5] org.springframework.web.servlet.handler.AbstractHandlerExceptionResolver: Resolved [org.springframework.web.HttpRequestMethodNotSupportedException: Request method 'POST' not supported]
2021-08-18 10:18:57,889 DEBUG [https-jsse-nio-8443-exec-5] org.springframework.web.servlet.FrameworkServlet: Exiting from "ERROR" dispatch, status 405
2021-08-18 10:18:57,890 DEBUG [https-jsse-nio-8443-exec-5] org.springframework.security.web.context.HttpSessionSecurityContextRepository$SaveToSessionResponseWrapper: Did not store anonymous SecurityContext
2021-08-18 10:18:57,890 DEBUG [https-jsse-nio-8443-exec-5] org.springframework.security.web.context.SecurityContextPersistenceFilter: Cleared SecurityContextHolder to complete request
2021-08-18 10:18:57,891 DEBUG [https-jsse-nio-8443-exec-5] org.apache.juli.logging.DirectJDKLog: Disabling the response for further output
2021-08-18 10:18:57,894 DEBUG [https-jsse-nio-8443-exec-5] org.apache.juli.logging.DirectJDKLog: Before fill(): parsingHeader: [true], parsingRequestLine: [true], parsingRequestLinePhase: [0], parsingRequestLineStart: [0], byteBuffer.position(): [0], byteBuffer.limit(): [0], end: [618]
2021-08-18 10:18:57,894 DEBUG [https-jsse-nio-8443-exec-5] org.apache.juli.logging.DirectJDKLog: Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@bc2db3b:org.apache.tomcat.util.net.SecureNioChannel@3e54873f:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8443 remote=/0:0:0:0:0:0:0:1:64732]], Read from buffer: [0]
2021-08-18 10:18:57,894 DEBUG [https-jsse-nio-8443-exec-5] org.apache.juli.logging.DirectJDKLog: Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@bc2db3b:org.apache.tomcat.util.net.SecureNioChannel@3e54873f:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8443 remote=/0:0:0:0:0:0:0:1:64732]], Read direct from socket: [0]
2021-08-18 10:18:57,894 DEBUG [https-jsse-nio-8443-exec-5] org.apache.juli.logging.DirectJDKLog: Received []
2021-08-18 10:18:57,895 DEBUG [https-jsse-nio-8443-exec-5] org.apache.juli.logging.DirectJDKLog: Socket: [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@bc2db3b:org.apache.tomcat.util.net.SecureNioChannel@3e54873f:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8443 remote=/0:0:0:0:0:0:0:1:64732]], Status in: [OPEN_READ], State out: [OPEN]
2021-08-18 10:18:57,895 DEBUG [https-jsse-nio-8443-exec-5] org.apache.juli.logging.DirectJDKLog: Pushed Processor [org.apache.coyote.http11.Http11Processor@cdb384c]
2021-08-18 10:18:57,895 DEBUG [https-jsse-nio-8443-exec-5] org.apache.juli.logging.DirectJDKLog: Registered read interest for [org.apache.tomcat.util.net.NioEndpoint$NioSocketWrapper@bc2db3b:org.apache.tomcat.util.net.SecureNioChannel@3e54873f:java.nio.channels.SocketChannel[connected local=/0:0:0:0:0:0:0:1:8443 remote=/0:0:0:0:0:0:0:1:64732]]
I have found issues where people are getting 403 instead of 405, I looked at this Baeldung page and it seems to indicate that it should go to the requested entry point. I have tried authenticating my JSESSION id and then going to the VERIFY_BADGE_URL and I still get the 405 status.
Any guidance would be appreciated!
Thanks to @neofelis response, he mentioned the /error page not supporting post requests.
That got me thinking I only have a @GetMapping method in there. So of course the POST methods were hitting /error and post wasn't supported which was causing this error.
I fixed this by adding the following method to the error controller.
@PostMapping("/error")
@ResponseBody
public String handlePostError(HttpServletRequest request) {
int status = getResponseStatus(request);
if (status == HttpStatus.FORBIDDEN.value()) {
return "uh uh uh, you didn't say the magic word ;)";
}
return "Well..... That doesn't seem right :/";
}
private int getResponseStatus(HttpServletRequest request) {
Object status = request.getAttribute(RequestDispatcher.ERROR_STATUS_CODE);
if (status != null) {
return Integer.parseInt(status.toString());
}
return -1;
}