Spring Security Disable Login / Redirect Page

Question

Is there a way to disable redirection for Spring Security and the login page. My requirements indicate that the login should be part of the navigation menu.

Example:

Therefore, there is no dedicated login page. Login information must be sent via Ajax. If an error occurs, it should return a JSON indicating the error and use the correct HTTP status code. If authentication is verified, it should return 200, and then javascript can process it from there.

I hope this makes sense if there is no easier way to do this with Spring Security. I do not have much experience with Spring Security. I suppose this should be common practice, but I have not found much.

Current Spring Security Configuration

@Configuration @EnableGlobalMethodSecurity(prePostEnabled = true) @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private UserDetailsService userDetailsService; @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests() .antMatchers("/", "/public/**").permitAll() .antMatchers("/about").permitAll() .anyRequest().fullyAuthenticated() .and() .formLogin() .loginPage("/login") .failureUrl("/login?error") .usernameParameter("email") .permitAll() .and() .logout() .logoutUrl("/logout") .deleteCookies("remember-me") .logoutSuccessUrl("/") .permitAll() .and() .rememberMe(); } @Override public void configure(AuthenticationManagerBuilder auth) throws Exception { auth .userDetailsService(userDetailsService) .passwordEncoder(new BCryptPasswordEncoder()); } 

Update:

I tried using HttpBasic (), but then it asks for credit to log in, no matter what and how ugly the browser pop-up is, which is not acceptable for the end user. It looks like I might have to extend AuthenticationEntryPoint.

At the end of the day, I need Spring Security to send JSON back saying that the authentication was successful or failed.

Answer 1

The redirection behavior comes from SavedRequestAwareAuthenticationSuccessHandler, which is the default success handler . Thus, a simple solution to remove redirects is to write your own success handler. for instance

 http.formLogin().successHandler(new AuthenticationSuccessHandler() { @Override public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException { //do nothing } }); 

Answer 2

In my project, I implemented it for requirements:

1) For status 401 of a holiday state if the user is not authorized

2) For a simple page 302 redirect to the login page if the user is not logged in

 public class AccessDeniedFilter extends GenericFilterBean { @Override public void doFilter( ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException { try { filterChain.doFilter(request, response); } catch (Exception e) { if (e instanceof NestedServletException && ((NestedServletException) e).getRootCause() instanceof AccessDeniedException) { HttpServletRequest rq = (HttpServletRequest) request; HttpServletResponse rs = (HttpServletResponse) response; if (isAjax(rq)) { rs.sendError(HttpStatus.FORBIDDEN.value()); } else { rs.sendRedirect("/#sign-in"); } } } } private Boolean isAjax(HttpServletRequest request) { return request.getContentType() != null && request.getContentType().contains("application/json") && request.getRequestURI() != null && (request.getRequestURI().contains("api") || request.getRequestURI().contains("rest")); } } 

And turn on the filter:

 @Override protected void configure(HttpSecurity http) throws Exception { ... http .addFilterBefore(new AccessDeniedFilter(), FilterSecurityInterceptor.class); ... } 

You can change the AccessDeniedException handle for your requirements in the condition:

 if (isAjax(rq)) { rs.sendError(HttpStatus.FORBIDDEN.value()); } else { rs.sendRedirect("/#sign-in"); } 

Answer 3

When the browser receives 401 with "WWW-Authetication: Basic ...", it opens a dialog box. Spring Security sends this header if it does not see "X-Requested-With" in the request.

You should send the “X-Requested-With: XMLHttpRequest” header for all requests, this is an old-fashioned way of saying, “I am an AJAX request.

Answer 4

For annotation-based settings, use the following:

 .defaultSuccessUrl("/dashboard",true)