Yesterday I did small exercise. I upgraded one of my old applications from xml (web.xml) configuration to class version as a first step to later upgrading.
There was no problems until I run application and all world could see everything what only an authorized user should see.
I couldn't find simple example which I could I adopt to my needs so I decided to describe this by my self.
Some examples proposed to extend
AbstractSecurityWebApplicationInitializer, other proposed to import just
import security configuration but it wasn't work as I expected. I created servlet initializer as below.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
| public class StockDispatcherServletInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {
@Override
protected Class<?>[] getRootConfigClasses() {
return new Class<?>[]{MySecurityConfig.class, MyRootConfig.class};
}
@Override
protected Class<?>[] getServletConfigClasses() {
return new Class<?>[]{MyServletConfig.class};
}
@Override
protected String[] getServletMappings() {
return new String[]{"/"};
}
protected Filter[] getServletFilters() {
return new Filter[]{new DelegatingFilterProxy("springSecurityFilterChain")};
}
}
|
MySecurityConfig I extended with WebSecurityConfigurerAdapter and implemented configure method as below:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
| @EnableWebSecurity
@Configuration
@ComponentScan("org.my")
public class SecurityConfig extends WebSecurityConfigurerAdapter {
private final MyLogoutSuccessHandler myLogoutSuccessHandler;
private final MyAuthenticationProviderImpl myAuthenticationProvider;
public SecurityConfig(final MyLogoutSuccessHandler myLogoutSuccessHandler,
final MyAuthenticationProviderImpl myAuthenticationProvider) {
this.myLogoutSuccessHandler = myLogoutSuccessHandler;
this.myAuthenticationProvider = myAuthenticationProvider;
}
@Autowired
public void configureGlobal(final AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(myAuthenticationProvider);
}
@Override
public void configure(final WebSecurity web) {
web.ignoring()
.antMatchers("/css/**")
.antMatchers("/img/**");
}
@Override
protected void configure(final HttpSecurity http) throws Exception {
formLogin(http);
logout(http);
headers(http);
authorizeRequests(http);
sessionManagement(http);
}
.......
}
|
MyServletConfig looks like
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
| @EnableWebMvc
@Configuration
@ComponentScan({"org.**.mvc"})
public class StockServletConfig implements WebMvcConfigurer {
@Override
public void addResourceHandlers(final ResourceHandlerRegistry registry) {
registry.addResourceHandler("/img/**").addResourceLocations("/img/");
registry.addResourceHandler("/css/**").addResourceLocations("/css/");
}
@Bean
ViewResolver viewResolver() {
return new InternalResourceViewResolver("/WEB-INF/jsp/", ".jsp");
}
@Bean
PropertiesFactoryBean propertiesFactoryBean() {
final PropertiesFactoryBean propertiesFactoryBean = new PropertiesFactoryBean();
propertiesFactoryBean.setLocation(new ClassPathResource("version.properties"));
return propertiesFactoryBean;
}
@Bean
ObjectMapper customObjectMapper() {
return new CustomObjectMapper();
}
@Bean
LocaleResolver localeResolver() {
final SessionLocaleResolver sessionLocaleResolver = new SessionLocaleResolver();
sessionLocaleResolver.setDefaultLocale(ENGLISH);
return sessionLocaleResolver;
}
@Bean
public LocaleChangeInterceptor localeChangeInterceptor() {
final LocaleChangeInterceptor localeChangeInterceptor = new LocaleChangeInterceptor();
localeChangeInterceptor.setParamName("lang");
return localeChangeInterceptor;
}
@Override
public void addInterceptors(final InterceptorRegistry registry) {
registry.addInterceptor(localeChangeInterceptor());
}
@Override
public void configureMessageConverters(final List<HttpMessageConverter<?>> messageConverters) {
messageConverters.add(new MappingJackson2HttpMessageConverter(customObjectMapper()));
}
}
|
Now I am analysing MyServletConfig and it is possible to do it other way - by adding some specific interceptor. Nevertheless current solution works:)
Any other better ideas ???
--
I used in example Spring/Spring Security 5.2.1 and Apache Tomcat 8.5.50
