Welcome. Ask away! Unless otherwise specified we assume you're using the latest 5.x version of Spring Security
Set-Cookie header with the JSESSIONID triggers a firewall rule. Does anyone know whether any update in Spring Security or Spring Boot might be the reason that this header is set now? Other services that use the same setup don't have this header set in their responses. Unfortunately tracking down why this header is set now is difficult, because the service that shows this behaviour is the result of two services being merged, so there was quite some change going on. The underlying setup as such however didn't change, it's based on Spring Boot 2.1.6 (and we're using a custom, but shared Resource Server Setup in all our services)
Hi @rolaca11, thank you for wanting to contribute. The best thing you can do to explain your use case is start with a test that shows how a request fails in one commit. Then add a second commit that makes the test pass.
This will give whoever reviews your PR a great deal of information on what you are trying to accomplish, and that it actually works in the code.
Commit 1 - a test case that fails, but you believe it should pass
Commit 2 - fixes the code, causes the test in Commit 1 to pass
Hello, I just bumped Spring Boot version from 2.2.0.M4 -> 2.2.0.M6. As a result Spring Security version went from 5.2.0.M3 -> 5.2.0.RC1. With this change my previous OAuth2 resource server security configuration fails at startup with an exception java.lang.IllegalArgumentException: An AuthenticationManager is required. In version 5.2.0.M3 a default manager with JwtAuthenticationProvider would be created. It appears this issue only occurs when I disable anonymous and have an authorizeRequests section in my HttpSecurity configuration as in the example below.
protected void configure(HttpSecurity http) throws Exception {
http.anonymous()
.disable()
.authorizeRequests()
.anyRequest().authenticated()
.and()
.oauth2ResourceServer()
.jwt();
}Do I need to provide an authentication manager rather than relying on the default in this case?
HeaderWriterFilter
RequestCacheAwareFilter
WebSecurityConfigurationAdapter. In my setup I have a different WebSecurityConfigurationAdapter for my Actuator endpoints and different profiles. Right now I provide those via bean and profile annotations. If I override the one of those adapters authenticationManagerBean() method it doesn't take effect. I guess I could declare them as components rather than just creating beans so the bean gets picked up... My question is it expected that disabling anonymous access cause no default AuthenticationManager for oauth2resourceserver?
@AutoConfigureWebTestClient which expects a working security configuration in order to start the context at all? Maybe we can solve it with your suggestions …
Hi
Could someone help me please? I'm getting empty username parameter in findByUsername(String username) in ReactiveUserDetailsService
In my security config I defined this:
.formLogin()
.loginPage("/login")
.authenticationManager(new UserDetailsRepositoryReactiveAuthenticationManager(authService))where authService is Autowired ReactiveUserDetailsService
I'm sending POST request to /login with parameters:
{
"username": "<some_username>",
"password": "<some_password>"
}There is not controller implementing /login Spring security somehow itslef managing it, so I'm getting hit straight into ReactiveUserDetailsService but obviously request params were not properly mapped, I'm definitely missing something
username only from Authentication object,so if I'll replace
.authenticationManager(new UserDetailsRepositoryReactiveAuthenticationManager(authService))with custom
ReactiveAuthenticationManager with implementation of authenticate(Authentication authentication)the
authentication parameter is also empty, and I'm not sure where do I get request body content to return proper Authentication object with username and password
/login/oauth2/code endpoint which 302s to https://accounts.google.com/o/oauth2/v2/auth which seems correct. Domain and SSL cert are matching/correct.
https://stackoverflow.com/questions/58327875/setting-a-defaultauthenticationeventpublisher-in-websecurityconfigureradapter-fo
hasAnyIpAddress(String[] ipAddresses) expression to be an extension to current hasIpAddress(String ipAddress). Context: I had to to allow some endpoints to be used only by specified machines that could not be described as normal ip range expression (eg. "192.168.1.1/24"). To accomplish that I had to use some weird string based expression ("hasIpAddress('...') or hasIpAddress('...')") which was dynamically generated. What do you think about that?
I recently did upgrade of spring boot 2.1.7 and suddently I was not getting and error message ..I found some idea with the below issue
spring-projects/spring-security#4467
so to fix this ..i have given this
antMatchers("/error").permitAll()
but now I m getting the error messgae but message are coming different
so previously before upgrade when i was putting wrong username/pwd ...the response was
"timestamp": 1571049553776,
"status": 401,
"error": "Unauthorized",
"message": "Authentication Failed: {\"errorCode\":\"52e\",\"adminMail\":\"System Administrator\",\"role\":[]}",
"path": "/login/auth"
}
"timestamp": "2019-10-14T10:40:37.651+0000",
"status": 401,
"error": "Unauthorized",
"message": "Unauthorized",
"path": "/login/auth"
}
Hi all,
I need help with the next case:
https://gist.github.com/SteelAlex/ac129a8099c9518e50f6815b3c2bfe1f - I configured Spring Security + Spring Session. I use custom header for session. And I can't change session timeout, I always logout after default 15 minutes of inactivity. I tried to set spring.session.timeout and/or server.servlet.session.timeout, but it doesn't work.
I am sure I am doing something wrong, but I have no ideas what.
