I was try write demo about spring security3, and come with problem that hasRole()
is not effect, here is part of code, each request will be transfer to exceptionHandling()
.
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {=
String[] userResource = this.appendPrefix(securityProps.getUserUrls());
final String[] adminResource = this.appendPrefix(securityProps.getAdminUrls());
final String[] commonResource = this.appendPrefix(securityProps.getCommonUrls());
=
http.authorizeHttpRequests(auth -> {
// grant resource to role
auth.requestMatchers(userResource).hasRole(SecurityConst.ROLE_USER)
.requestMatchers(adminResource).hasRole(SecurityConst.ROLE_ADMIN)
// whitelist
.requestMatchers(commonResource).permitAll()
// default need auth
.anyRequest().authenticated();
})
.httpBasic(Customizer.withDefaults())
// login config
.formLogin(form -> {
form.loginProcessingUrl(securityProps.getLoginUrl().trim()).permitAll()
.successHandler(this::loginSuccessHandle)
.failureHandler(this::loginFailureHandle);
})
.logout(LogoutConfigurer::permitAll)
.exceptionHandling(handle -> {
handle.authenticationEntryPoint(this::unAuthHandle);
})
.addFilterBefore(requestFilter(), UsernamePasswordAuthenticationFilter.class)
.csrf(AbstractHttpConfigurer::disable)
.cors(Customizer.withDefaults());
return http.build();
}
but if I try replace it with auth.requestMatchers("/**").permitAll()
it was not problem.
It stuck me few hour, can someone help me, here is my full code in github: GitHub Repo