Spring Security forces log in screen even with permit all specification

Cooler166

I have a basic spring security filter chain with form login. And whenever I try to bypass the login screen it just redirects back to it.

Specifically, trying to access public still redirects back to the login page.

    @Bean
    public SecurityFilterChain securityFilterChain (HttpSecurity sec) throws Exception
    {
        sec.csrf().disable()
                .authorizeHttpRequests()
                .requestMatchers("home/normal")
                .hasRole("NORMAL")
                .requestMatchers("home/admin")
                .hasRole("ADMIN")
                .requestMatchers("/home/public", "/home/add")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .formLogin();
        return sec.build();
    }
Youans

I believe this could happen not because of the /home/public nor /home/add when you request a page from the server, browsers will request the favicon as well so they issue /favicon.ico request against the server so make sure to allow it as well

So update your code as follows:

...
.requestMatchers("/home/public", "/home/add", "/favicon.ico")
.permitAll()

You can open the dev tools in the browser and check the network tab if there are any XHR requests against a server that needed to be allowed also.

Collected from the Internet

Please contact [email protected] to delete if infringement.

edited at
0

Comments

0 comments
Login to comment

Related

Spring Security - ant matcher permit all not working

Spring security permit a url

how to secure only one url with spring security and permit all

Spring Security - permit only requests with prefix

Spring Security only permit anonymous to access

How to permit single url in spring security

spring security is authenticating all requests even though they are permitted

Spring MVC: log all requests, even the resource not founds

Spring security 401 Unauthorized even with permitAll

Spring Security - Login Fails even if good credentials

activemq-all forces me to use log4j slf4j implementation

Spring Security denying all users

How to disable spring-security login screen?

How to disable Spring Security's login screen?

How to log in by email instead of username in Spring security

Spring security: log in using roles from database

How to log out automatically with Spring Security

Why does spring security log out the user?

I cannot log using spring security

Log out user by admin Spring Security

Removing a log from Spring Security authentication logging

Grails Spring Security Core unable to log in

Spring, Spring-security : Spring-security returning 302, even if login failed

terraform > forces new resource on security group

All com.android.support libraries must use the exact same version specification even after versions are same

Splash Screen Activity forces my device to restart

Detect all taps anywhere on the screen, even when displaying a dialog?

Spring Security using CSRF token even though not specified and turned off

Retrieve Spring Security's Authentication, even on public pages with filter="none"

TOP Ranking

  1. 1

    Failed to listen on localhost:8000 (reason: Cannot assign requested address)

  2. 2

    pump.io port in URL

  3. 3

    How to import an asset in swift using Bundle.main.path() in a react-native native module

  4. 4

    Loopback Error: connect ECONNREFUSED 127.0.0.1:3306 (MAMP)

  5. 5

    Compiler error CS0246 (type or namespace not found) on using Ninject in ASP.NET vNext

  6. 6

    BigQuery - concatenate ignoring NULL

  7. 7

    Spring Boot JPA PostgreSQL Web App - Internal Authentication Error

  8. 8

    ggplotly no applicable method for 'plotly_build' applied to an object of class "NULL" if statements

  9. 9

    ngClass error (Can't bind ngClass since it isn't a known property of div) in Angular 11.0.3

  10. 10

    How to remove the extra space from right in a webview?

  11. 11

    Change dd-mm-yyyy date format of dataframe date column to yyyy-mm-dd

  12. 12

    Jquery different data trapped from direct mousedown event and simulation via $(this).trigger('mousedown');

  13. 13

    maven-jaxb2-plugin cannot generate classes due to two declarations cause a collision in ObjectFactory class

  14. 14

    java.lang.NullPointerException: Cannot read the array length because "<local3>" is null

  15. 15

    How to use merge windows unallocated space into Ubuntu using GParted?

  16. 16

    flutter: dropdown item programmatically unselect problem

  17. 17

    Pandas - check if dataframe has negative value in any column

  18. 18

    Nuget add packages gives access denied errors

  19. 19

    Can't pre-populate phone number and message body in SMS link on iPhones when SMS app is not running in the background

  20. 20

    Generate random UUIDv4 with Elm

  21. 21

    Client secret not provided in request error with Keycloak

HotTag

Archive