Spring security throw unauthorized instead of redirecting to login

Ben :

I wish that my spring web application would simply return status code 403 UNAUTHORIZED instead of redirecting to /login when user is trying to access resource without being logged in or having the correct authorities.

I currently have my spring security set up with oauth2 client login, but I believe it has the same behavior with basic login as well.

@Override
protected void configure(HttpSecurity http) throws Exception
{
    http.csrf().disable()
            .authorizeRequests()
            .antMatchers("/allowed").permitAll()
            .anyRequest()
            .authenticated()
            .and()
            .oauth2Login(this::configureOauthLogin) // sets up custom user services
            .exceptionHandling()
            .accessDeniedHandler((request, response, accessDeniedException) -> {
                response.setStatus(HttpStatus.UNAUTHORIZED.value());
            });
}

I've tried dealing with it with providing accessDeniedHandler but I don't see that it changes anything as this handler is never actually triggered.

TLDR

Make spring throw 403 instead of 302 on unauthorized requests.

EDIT

Here's a dump of my filter chain

filters = {ArrayList@6668}  size = 14
 0 = {WebAsyncManagerIntegrationFilter@6635} 
 1 = {SecurityContextPersistenceFilter@6634} 
 2 = {HeaderWriterFilter@6633} 
 3 = {LogoutFilter@6632} 
 4 = {OAuth2AuthorizationRequestRedirectFilter@6631} 
 5 = {OAuth2LoginAuthenticationFilter@6630} 
 6 = {DefaultLoginPageGeneratingFilter@6629} 
 7 = {DefaultLogoutPageGeneratingFilter@6628} 
 8 = {RequestCacheAwareFilter@6627} 
 9 = {SecurityContextHolderAwareRequestFilter@6626} 
 10 = {AnonymousAuthenticationFilter@6625} 
 11 = {SessionManagementFilter@6624} 
 12 = {ExceptionTranslationFilter@6623} 
 13 = {FilterSecurityInterceptor@6622} 
Ben :

I figured it out, turns out this flow of controll is handled by authenticationEntryPoint in the security config. The following code provides the desired behavior:

         http   
            .exceptionHandling()
            .authenticationEntryPoint(new Http403ForbiddenEntryPoint())

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

How The Spring Security is redirecting to Login page if User is unauthorized

Spring Security keeps redirecting me to login page

Spring Security Always Redirecting to "/" After Login

Spring security : redirecting to the login page after loggin in

Spring security jsf not redirecting after successsfull login

Spring Boot Security does not throw 401 Unauthorized Exception but 404 Not Found

Prevent Spring Security from 302 redirecting after login/logout

Spring security custom login form redirecting to resource not available

Spring security redirecting to a page after login using redirect: uri

In Spring Security config Urls which are permitted for all are not accessable and redirecting to login

How to avoid redirecting to login form for some URL with Spring Security?

Spring Security redirecting custom login page to itself - Too Many Redirects

How to login by email instead of username in spring security

401 Unauthorized Error in Spring Security

Spring Security's permitAll Unauthorized

Spring Security - 401 Unauthorized access

401 unauthorized error while call to login with spring security rest plugin in grails app

The page isn’t redirecting properly error while accessing http://localhost:8080/login in spring security

Security implications of redirecting to an unescaped URL after login

Laravel http test redirecting to \ instead of login

Spring Security does not throw Error when authorization header is not present after login with AngularJS

How can I redirect users after logging in to the home page and throw out a 200 instead of a 302 with Spring Security?

Spring security occasionally redirects to default page instead of pre-login page after successful login

How can I use an Angular login instead of Spring Security's login for my OAuth2 server?

Spring security - login architecture

Spring security with login with amazon

Special Login with Spring Security

Spring Security Login Page

Auto login with spring security