Mixing
Getting forbidden error all url in spring security (Spring boot)
I have configured spring security. I have created a login form, to sign in into my application. But getting forbidden error for any authorized "USER" or "ADMIN" role based url. But all permitAll permission url working fine.
In configuration file...
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private DataSource dataSource;
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/bootstrap/**");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/home").hasRole("user")
.antMatchers("/admin").hasRole("admin")
.antMatchers("/**").denyAll()
.and()
.formLogin()
.loginPage("/")
.permitAll()
.and()
.logout()
.permitAll()
.and()
.httpBasic()
.and()
.csrf()
.disable();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.jdbcAuthentication().dataSource(dataSource).passwordEncoder(new BCryptPasswordEncoder());
}
@Bean
public PasswordEncoder encoder() {
return new BCryptPasswordEncoder();
}
}
In controller class
@Controller
public class HomeController {
@RequestMapping(value= {"/", "/index"}, method=RequestMethod.GET)
public String showHome() {
return "index";
}
@RequestMapping(value="/home")
public String login() {
return "home";
}
@RequestMapping(value="/admin")
public String showDashboard() {
return "dashboard";
}
}
In login form,
<form class="form-signin" th:action="@{/}" method="post">
...
...
...
</form>
In pom.xml
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
N.B. The application is compiled and run successfully, no stack trace given. Just give me forbidden error.
I can't found, where I have made an error. Please, can you help me?
Thanks in advance.
spring-boot spring-security
asked Jan 1 at 12:35
RashedRashed
7510
|
show 2 more comments
I have configured spring security. I have created a login form, to sign in into my application. But getting forbidden error for any authorized "USER" or "ADMIN" role based url. But all permitAll permission url working fine.
In configuration file...
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private DataSource dataSource;
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/bootstrap/**");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/home").hasRole("user")
.antMatchers("/admin").hasRole("admin")
.antMatchers("/**").denyAll()
.and()
.formLogin()
.loginPage("/")
.permitAll()
.and()
.logout()
.permitAll()
.and()
.httpBasic()
.and()
.csrf()
.disable();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.jdbcAuthentication().dataSource(dataSource).passwordEncoder(new BCryptPasswordEncoder());
}
@Bean
public PasswordEncoder encoder() {
return new BCryptPasswordEncoder();
}
}
In controller class
@Controller
public class HomeController {
@RequestMapping(value= {"/", "/index"}, method=RequestMethod.GET)
public String showHome() {
return "index";
}
@RequestMapping(value="/home")
public String login() {
return "home";
}
@RequestMapping(value="/admin")
public String showDashboard() {
return "dashboard";
}
}
In login form,
<form class="form-signin" th:action="@{/}" method="post">
...
...
...
</form>
In pom.xml
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
N.B. The application is compiled and run successfully, no stack trace given. Just give me forbidden error.
I can't found, where I have made an error. Please, can you help me?
Thanks in advance.
spring-boot spring-security
asked Jan 1 at 12:35
RashedRashed
7510
How do you load your role ? What's the sql ? Do you have the role define in the database ?
– chaoluo
Jan 1 at 15:00
I have two tables, one is, users table where the field name is username, password and enabled and another one is, authorities table where the field name is username and authority. I followed this tutorial, database part only. youtube.com/watch?v=uxbtIqaKsOA
– Rashed
Jan 1 at 18:42
@Rashed Possible duplicate of stackoverflow.com/questions/41946473/… or it is just a typo (lower case instead of upper case)?
– dur
Jan 1 at 21:48
no, I tried both upper and lower case but didn't work. @dur
– Rashed
Jan 2 at 3:57
1
The role name is ROLE_ADMIN or ADMIN ?
– chaoluo
Jan 2 at 4:21
|
show 2 more comments
I have configured spring security. I have created a login form, to sign in into my application. But getting forbidden error for any authorized "USER" or "ADMIN" role based url. But all permitAll permission url working fine.
In configuration file...
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private DataSource dataSource;
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/bootstrap/**");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/home").hasRole("user")
.antMatchers("/admin").hasRole("admin")
.antMatchers("/**").denyAll()
.and()
.formLogin()
.loginPage("/")
.permitAll()
.and()
.logout()
.permitAll()
.and()
.httpBasic()
.and()
.csrf()
.disable();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.jdbcAuthentication().dataSource(dataSource).passwordEncoder(new BCryptPasswordEncoder());
}
@Bean
public PasswordEncoder encoder() {
return new BCryptPasswordEncoder();
}
}
In controller class
@Controller
public class HomeController {
@RequestMapping(value= {"/", "/index"}, method=RequestMethod.GET)
public String showHome() {
return "index";
}
@RequestMapping(value="/home")
public String login() {
return "home";
}
@RequestMapping(value="/admin")
public String showDashboard() {
return "dashboard";
}
}
In login form,
<form class="form-signin" th:action="@{/}" method="post">
...
...
...
</form>
In pom.xml
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
N.B. The application is compiled and run successfully, no stack trace given. Just give me forbidden error.
I can't found, where I have made an error. Please, can you help me?
Thanks in advance.
spring-boot spring-security
asked Jan 1 at 12:35
RashedRashed
7510
I have configured spring security. I have created a login form, to sign in into my application. But getting forbidden error for any authorized "USER" or "ADMIN" role based url. But all permitAll permission url working fine.
In configuration file...
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private DataSource dataSource;
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/bootstrap/**");
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/home").hasRole("user")
.antMatchers("/admin").hasRole("admin")
.antMatchers("/**").denyAll()
.and()
.formLogin()
.loginPage("/")
.permitAll()
.and()
.logout()
.permitAll()
.and()
.httpBasic()
.and()
.csrf()
.disable();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.jdbcAuthentication().dataSource(dataSource).passwordEncoder(new BCryptPasswordEncoder());
}
@Bean
public PasswordEncoder encoder() {
return new BCryptPasswordEncoder();
}
}
In controller class
@Controller
public class HomeController {
@RequestMapping(value= {"/", "/index"}, method=RequestMethod.GET)
public String showHome() {
return "index";
}
@RequestMapping(value="/home")
public String login() {
return "home";
}
@RequestMapping(value="/admin")
public String showDashboard() {
return "dashboard";
}
}
In login form,
<form class="form-signin" th:action="@{/}" method="post">
...
...
...
</form>
In pom.xml
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
N.B. The application is compiled and run successfully, no stack trace given. Just give me forbidden error.
I can't found, where I have made an error. Please, can you help me?
Thanks in advance.
spring-boot spring-security
spring-boot spring-security
asked Jan 1 at 12:35
RashedRashed
7510
asked Jan 1 at 12:35
RashedRashed
7510
asked Jan 1 at 12:35
RashedRashed
7510
asked Jan 1 at 12:35
RashedRashed
7510
asked Jan 1 at 12:35
RashedRashed
7510
7510
How do you load your role ? What's the sql ? Do you have the role define in the database ?
– chaoluo
Jan 1 at 15:00
I have two tables, one is, users table where the field name is username, password and enabled and another one is, authorities table where the field name is username and authority. I followed this tutorial, database part only. youtube.com/watch?v=uxbtIqaKsOA
– Rashed
Jan 1 at 18:42
@Rashed Possible duplicate of stackoverflow.com/questions/41946473/… or it is just a typo (lower case instead of upper case)?
– dur
Jan 1 at 21:48
no, I tried both upper and lower case but didn't work. @dur
– Rashed
Jan 2 at 3:57
1
The role name is ROLE_ADMIN or ADMIN ?
– chaoluo
Jan 2 at 4:21
|
show 2 more comments
How do you load your role ? What's the sql ? Do you have the role define in the database ?
– chaoluo
Jan 1 at 15:00
I have two tables, one is, users table where the field name is username, password and enabled and another one is, authorities table where the field name is username and authority. I followed this tutorial, database part only. youtube.com/watch?v=uxbtIqaKsOA
– Rashed
Jan 1 at 18:42
@Rashed Possible duplicate of stackoverflow.com/questions/41946473/… or it is just a typo (lower case instead of upper case)?
– dur
Jan 1 at 21:48
no, I tried both upper and lower case but didn't work. @dur
– Rashed
Jan 2 at 3:57
1
The role name is ROLE_ADMIN or ADMIN ?
– chaoluo
Jan 2 at 4:21
How do you load your role ? What's the sql ? Do you have the role define in the database ?
– chaoluo
Jan 1 at 15:00
How do you load your role ? What's the sql ? Do you have the role define in the database ?
– chaoluo
Jan 1 at 15:00
I have two tables, one is, users table where the field name is username, password and enabled and another one is, authorities table where the field name is username and authority. I followed this tutorial, database part only. youtube.com/watch?v=uxbtIqaKsOA
– Rashed
Jan 1 at 18:42
I have two tables, one is, users table where the field name is username, password and enabled and another one is, authorities table where the field name is username and authority. I followed this tutorial, database part only. youtube.com/watch?v=uxbtIqaKsOA
– Rashed
Jan 1 at 18:42
@Rashed Possible duplicate of stackoverflow.com/questions/41946473/… or it is just a typo (lower case instead of upper case)?
– dur
Jan 1 at 21:48
@Rashed Possible duplicate of stackoverflow.com/questions/41946473/… or it is just a typo (lower case instead of upper case)?
– dur
Jan 1 at 21:48
no, I tried both upper and lower case but didn't work. @dur
– Rashed
Jan 2 at 3:57
no, I tried both upper and lower case but didn't work. @dur
– Rashed
Jan 2 at 3:57
1
1
The role name is ROLE_ADMIN or ADMIN ?
– chaoluo
Jan 2 at 4:21
The role name is ROLE_ADMIN or ADMIN ?
– chaoluo
Jan 2 at 4:21
|
show 2 more comments
1 Answer
1
active
oldest
votes
Here is the default sql to load username, password and authority from database.
public static final String DEF_USERS_BY_USERNAME_QUERY = "select username,password,enabled "
+ "from users " + "where username = ?";
public static final String DEF_AUTHORITIES_BY_USERNAME_QUERY = "select username,authority "
+ "from authorities " + "where username = ?";
And role is just a authority that start with ROLE_, hasRole('XXX') is same as hasAuthority('ROLE_XXX')
So you can change the role name in database to ROLE_ADMIN,
or you can use hasAuthority('admin') instead of hasRole
answered Jan 2 at 11:49
chaoluochaoluo
1,6301916
Thanks! It's working.
– Rashed
Jan 2 at 13:57
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53995473%2fgetting-forbidden-error-all-url-in-spring-security-spring-boot%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Here is the default sql to load username, password and authority from database.
public static final String DEF_USERS_BY_USERNAME_QUERY = "select username,password,enabled "
+ "from users " + "where username = ?";
public static final String DEF_AUTHORITIES_BY_USERNAME_QUERY = "select username,authority "
+ "from authorities " + "where username = ?";
And role is just a authority that start with ROLE_, hasRole('XXX') is same as hasAuthority('ROLE_XXX')
So you can change the role name in database to ROLE_ADMIN,
or you can use hasAuthority('admin') instead of hasRole
answered Jan 2 at 11:49
chaoluochaoluo
1,6301916
Thanks! It's working.
– Rashed
Jan 2 at 13:57
add a comment |
Here is the default sql to load username, password and authority from database.
public static final String DEF_USERS_BY_USERNAME_QUERY = "select username,password,enabled "
+ "from users " + "where username = ?";
public static final String DEF_AUTHORITIES_BY_USERNAME_QUERY = "select username,authority "
+ "from authorities " + "where username = ?";
And role is just a authority that start with ROLE_, hasRole('XXX') is same as hasAuthority('ROLE_XXX')
So you can change the role name in database to ROLE_ADMIN,
or you can use hasAuthority('admin') instead of hasRole
answered Jan 2 at 11:49
chaoluochaoluo
1,6301916
Thanks! It's working.
– Rashed
Jan 2 at 13:57
add a comment |
Here is the default sql to load username, password and authority from database.
public static final String DEF_USERS_BY_USERNAME_QUERY = "select username,password,enabled "
+ "from users " + "where username = ?";
public static final String DEF_AUTHORITIES_BY_USERNAME_QUERY = "select username,authority "
+ "from authorities " + "where username = ?";
And role is just a authority that start with ROLE_, hasRole('XXX') is same as hasAuthority('ROLE_XXX')
So you can change the role name in database to ROLE_ADMIN,
or you can use hasAuthority('admin') instead of hasRole
answered Jan 2 at 11:49
chaoluochaoluo
1,6301916
Here is the default sql to load username, password and authority from database.
public static final String DEF_USERS_BY_USERNAME_QUERY = "select username,password,enabled "
+ "from users " + "where username = ?";
public static final String DEF_AUTHORITIES_BY_USERNAME_QUERY = "select username,authority "
+ "from authorities " + "where username = ?";
And role is just a authority that start with ROLE_, hasRole('XXX') is same as hasAuthority('ROLE_XXX')
So you can change the role name in database to ROLE_ADMIN,
or you can use hasAuthority('admin') instead of hasRole
answered Jan 2 at 11:49
chaoluochaoluo
1,6301916
edited Jan 2 at 13:58
answered Jan 2 at 11:49
chaoluochaoluo
1,6301916
answered Jan 2 at 11:49
chaoluochaoluo
1,6301916
answered Jan 2 at 11:49
chaoluochaoluo
1,6301916
1,6301916
Thanks! It's working.
– Rashed
Jan 2 at 13:57
add a comment |
Thanks! It's working.
– Rashed
Jan 2 at 13:57
Thanks! It's working.
– Rashed
Jan 2 at 13:57
Thanks! It's working.
– Rashed
Jan 2 at 13:57
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53995473%2fgetting-forbidden-error-all-url-in-spring-security-spring-boot%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
How do you load your role ? What's the sql ? Do you have the role define in the database ?
– chaoluo
Jan 1 at 15:00
I have two tables, one is, users table where the field name is username, password and enabled and another one is, authorities table where the field name is username and authority. I followed this tutorial, database part only. youtube.com/watch?v=uxbtIqaKsOA
– Rashed
Jan 1 at 18:42
@Rashed Possible duplicate of stackoverflow.com/questions/41946473/… or it is just a typo (lower case instead of upper case)?
– dur
Jan 1 at 21:48
no, I tried both upper and lower case but didn't work. @dur
– Rashed
Jan 2 at 3:57
1
The role name is ROLE_ADMIN or ADMIN ?
– chaoluo
Jan 2 at 4:21