Announcement Announcement Module
Collapse
No announcement yet.
403 instead of login page redirect for REST WS Page Title Module
Move Remove Collapse
X
Conversation Detail Module
Collapse
  • Filter
  • Time
  • Show
Clear All
new posts

  • 403 instead of login page redirect for REST WS

    Hi everybody,

    We have an ExtJS javascript application with a Tomcat/Spring/SpringSecurity backend exposing REST services.

    We have the standard SpringSecurity redirection to the login page when the user is not authenticated and it loads the application the first time, but for the REST services (/services/*) we would like to receive the HTTP 403 instead of the html of the login page in the response.

    Do you please have an advice?
    Thanks in advance.

  • #2
    You will want to use the DelegatingAuthenticationEntryPoint. For help using it I would look at its javadoc and search for it on the forums. There are quite a few threads on it out there but this one is a pretty good one.

    Comment


    • #3
      Thank you for answer Rob,

      In fact what I would like to do is overriding the DefaultRedirectStrategy that is instanciated directly (why not DI :-) ) in the LoginUrlAuthenticationEntryPoint.

      Comment


      • #4
        Just to confirm...you were able to solve your problem then?

        Comment


        • #5
          Yes but in a very inelegant way. I had to create a CustomLoginUrlAuthenticationEntryPoint that is a raw copy of the LoginUrlAuthenticationEntryPoint (as this class is really not designed to be overrided) where I can inject a RedirectStrategy, and a CustomRedirectStrategy that sends a 403 for a list of urls instead of redirecting to the login page.

          Thanks for helping anyway.

          Comment


          • #6
            Glad you found a solution that works If you want a cleaner solution, I would recommend you look at the suggestion that I posted.

            Comment


            • #7
              I'm always interested in finding a clean(er) solution :-)

              I thought that the DelegatingAuthenticationEntryPoint was made to configure different EntryPoints based on a regexp, right?
              But I don't need two EntryPoints, but just a specific Redirect(ion)Strategy based on a regexp.
              Or did I miss something?

              Comment


              • #8
                Originally posted by pwanner View Post
                I thought that the DelegatingAuthenticationEntryPoint was made to configure different EntryPoints based on a regexp, right?
                An AuthenticationEntryPoint can do redirections and more.

                Originally posted by pwanner View Post
                But I don't need two EntryPoints, but just a specific Redirect(ion)Strategy based on a regexp.
                Or did I miss something?
                I think I may be a big confused with your requirements. You mentioned you would send a 403 for a list of URLs...403 does not include a redirect and thus I don't know why you would use a RedirectStrategy for this. The configuration below would send a 403 for any url that starts with /services/ and redirect to the login page for any other url.
                Code:
                <http ... entry-point-ref="entryPoint">
                ...
                </http>
                
                <b:bean id="entryPoint" class="org.springframework.security.web.authentication.DelegatingAuthenticationEntryPoint">
                  <b:constructor-arg>
                    <b:map>
                      <b:entry>
                        <b:key>
                          <b:bean class="ServicesRequestMatcher"/>
                        </b:key>
                        <b:bean class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/>
                      </b:entry>
                    </b:map>
                  </b:constructor-arg>
                  <b:property name="defaultEntryPoint">
                    <b:bean class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
                      <b:property name="loginFormUrl" value="/login"/>
                    </b:bean>
                  </b:property>
                </b:bean>
                
                public class ServicesRequestMatcher implements RequestMatcher {
                  public boolean matches(HttpServletRequest request) {
                    String url = UrlUtils.buildRequestUrl(request);
                    return url.startsWith("/services/");
                  }
                }
                If this is not what you are looking for, please clarify your requirements. An example might help to illustrate what you are looking for.

                Comment


                • #9
                  Hum! It seems that I didn't really understand how DelegatingAuthenticationEntryPoint works as the configuration above suits perfectly my needs and is MUCH nicer than what I wrote!

                  Thanks a lot Rob.

                  Comment

                  Working...
                  X