Thiết kế website giá rẻ

Question

I have a simple SecurityFilterChain configuration and a simple customAuthenticationFilter implementation.

The customAuthenticationFilter (addFilterBefore) just finds the ROLE’s from postgresql DB based on the username in the decoded JWT , other than that it is just a regular filterchain.

But when I tried to access any of the endpoint, spring security redirects its to /error path. I would be very appreciated if anyone point me the reason behind this.

@EnableWebSecurity
@EnableMethodSecurity
@Configuration
public class SecurityConfiguration {

    private final UserService userService;

    @Autowired
    public SecurityConfiguration(UserService userService) {
        this.userService = userService;
    }


    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                .addFilterBefore(customAuthenticationFilter(), BasicAuthenticationFilter.class)
                .authorizeHttpRequests(request -> request
                        .requestMatchers("/actuator/**").permitAll()
                        .anyRequest().authenticated()
                )
                .oauth2ResourceServer(oauth2 -> oauth2
                        .jwt(Customizer.withDefaults()));

        return http.build();
    }

    @Bean
    public RoleHierarchy roleHierarchy() {
        RoleHierarchyImpl roleHierarchy = new RoleHierarchyImpl();
        String hierarchy = "ROLE_ADMIN > ROLE_MODERATOR n ROLE_MODERATOR > ROLE_USER";
        roleHierarchy.setHierarchy(hierarchy);
        return roleHierarchy;
    }

    public CustomAuthenticationFilter customAuthenticationFilter() {
        return new CustomAuthenticationFilter(userService);
    }

Here is the TRACE log of spring boot where it redirects to /error path for no reason..

21:12:10.941 [http-nio-8082-exec-5] DEBUG org.springframework.security.web.FilterChainProxy – Securing GET /userlogin
21:12:10.941 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking DisableEncodeUrlFilter (1/14)
21:12:10.941 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking WebAsyncManagerIntegrationFilter (2/14)
21:12:10.942 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking SecurityContextHolderFilter (3/14)
21:12:10.942 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking HeaderWriterFilter (4/14)
21:12:10.942 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking CorsFilter (5/14)
21:12:10.942 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking CsrfFilter (6/14)
21:12:10.942 [http-nio-8082-exec-5] TRACE org.springframework.security.web.csrf.CsrfFilter – Did not protect against CSRF since request did not match And [CsrfNotRequired [TRACE, HEAD, GET, OPTIONS], Not [Or [org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer$BearerTokenRequestMatcher@463e0b6a]]]
21:12:10.942 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking LogoutFilter (7/14)
21:12:10.942 [http-nio-8082-exec-5] TRACE org.springframework.security.web.authentication.logout.LogoutFilter – Did not match request to Ant [pattern=’/logout’, POST]
21:12:10.942 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking BearerTokenAuthenticationFilter (8/14)
21:12:10.942 [http-nio-8082-exec-5] TRACE org.springframework.security.authentication.ProviderManager – Authenticating request with JwtAuthenticationProvider (1/2)
21:12:10.943 [http-nio-8082-exec-5] TRACE org.springframework.security.oauth2.server.resource.authentication.JwtGrantedAuthoritiesConverter – Returning no authorities since could not find any claims that might contain scopes
21:12:10.943 [http-nio-8082-exec-5] DEBUG org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationProvider – Authenticated token
21:12:10.944 [http-nio-8082-exec-5] DEBUG org.springframework.security.oauth2.server.resource.web.authentication.BearerTokenAuthenticationFilter – Set SecurityContextHolder to JwtAuthenticationToken [Principal=org.springframework.security.oauth2.jwt.Jwt@99c731b6, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=192.168.88.85, SessionId=96FED99CA7077F197D1F9684BA982785], Granted Authorities=[]]
21:12:10.944 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking CustomAuthenticationFilter (9/14)
Hibernate: select u1_0.id,u1_0.email,u1_0.username from user_table u1_0 where upper(u1_0.username)=upper(?)
21:12:10.945 [http-nio-8082-exec-5] DEBUG org.hibernate.SQL – select u1_0.id,u1_0.email,u1_0.username from user_table u1_0 where upper(u1_0.username)=upper(?)
Hibernate: select r1_0.user_id,r1_1.id,r1_1.description,r1_1.name from user_roles r1_0 join roles r1_1 on r1_1.id=r1_0.role_id where r1_0.user_id=?
21:12:10.947 [http-nio-8082-exec-5] DEBUG org.hibernate.SQL – select r1_0.user_id,r1_1.id,r1_1.description,r1_1.name from user_roles r1_0 join roles r1_1 on r1_1.id=r1_0.role_id where r1_0.user_id=?
21:12:10.949 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking RequestCacheAwareFilter (10/14)
21:12:10.949 [http-nio-8082-exec-5] TRACE org.springframework.security.web.savedrequest.HttpSessionRequestCache – matchingRequestParameterName is required for getMatchingRequest to lookup a value, but not provided
21:12:10.949 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking SecurityContextHolderAwareRequestFilter (11/14)
21:12:10.949 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking AnonymousAuthenticationFilter (12/14)
21:12:10.949 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking ExceptionTranslationFilter (13/14)
21:12:10.949 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking AuthorizationFilter (14/14)
21:12:10.949 [http-nio-8082-exec-5] TRACE org.springframework.security.web.access.intercept.RequestMatcherDelegatingAuthorizationManager – Authorizing SecurityContextHolderAwareRequestWrapper[ org.springframework.security.web.header.HeaderWriterFilter$HeaderWriterRequest@4a202ba1]
21:12:10.949 [http-nio-8082-exec-5] TRACE org.springframework.security.web.access.intercept.RequestMatcherDelegatingAuthorizationManager – Checking authorization on SecurityContextHolderAwareRequestWrapper[ org.springframework.security.web.header.HeaderWriterFilter$HeaderWriterRequest@4a202ba1] using org.springframework.security.authorization.AuthenticatedAuthorizationManager@20ec6fdd
21:12:10.949 [http-nio-8082-exec-5] TRACE org.springframework.security.web.authentication.AnonymousAuthenticationFilter – Did not set SecurityContextHolder since already authenticated UsernamePasswordAuthenticationToken [Principal=Y_SALDAMLI, Credentials=[PROTECTED], Authenticated=true, Details=null, Granted Authorities=[ROLE_ADMIN, ROLE_TEST, ROLE_USER]]
21:12:10.949 [http-nio-8082-exec-5] DEBUG org.springframework.security.web.FilterChainProxy – Secured GET /userlogin
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Trying to match request against DefaultSecurityFilterChain [RequestMatcher=any request, Filters=[org.springframework.security.web.session.DisableEncodeUrlFilter@597ef918, org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@1af6cd73, org.springframework.security.web.context.SecurityContextHolderFilter@5a720cdf, org.springframework.security.web.header.HeaderWriterFilter@69eb88a7, org.springframework.web.filter.CorsFilter@50cfe725, org.springframework.security.web.csrf.CsrfFilter@3fcc58f8, org.springframework.security.web.authentication.logout.LogoutFilter@472073bb, org.springframework.security.oauth2.server.resource.web.authentication.BearerTokenAuthenticationFilter@15c27b65, com.thy.rs13guipoc.config.CustomAuthenticationFilter@2baf2c6, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@1377af49, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@4ac7f844, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@2c226db0, org.springframework.security.web.access.ExceptionTranslationFilter@15cba6dc, org.springframework.security.web.access.intercept.AuthorizationFilter@25727f74]] (1/1)
21:12:10.951 [http-nio-8082-exec-5] DEBUG org.springframework.security.web.FilterChainProxy – Securing GET /error
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking DisableEncodeUrlFilter (1/14)
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking WebAsyncManagerIntegrationFilter (2/14)
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking SecurityContextHolderFilter (3/14)
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking HeaderWriterFilter (4/14)
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking CorsFilter (5/14)
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking CsrfFilter (6/14)
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking LogoutFilter (7/14)
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.authentication.logout.LogoutFilter – Did not match request to Ant [pattern=’/logout’, POST]
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking BearerTokenAuthenticationFilter (8/14)
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking CustomAuthenticationFilter (9/14)
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking RequestCacheAwareFilter (10/14)
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.savedrequest.HttpSessionRequestCache – matchingRequestParameterName is required for getMatchingRequest to lookup a value, but not provided
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking SecurityContextHolderAwareRequestFilter (11/14)
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking AnonymousAuthenticationFilter (12/14)
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking ExceptionTranslationFilter (13/14)
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.FilterChainProxy – Invoking AuthorizationFilter (14/14)
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.access.intercept.RequestMatcherDelegatingAuthorizationManager – Authorizing SecurityContextHolderAwareRequestWrapper[ FirewalledRequest[ org.apache.catalina.core.ApplicationHttpRequest@2d44adc5]]
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.access.intercept.RequestMatcherDelegatingAuthorizationManager – Checking authorization on SecurityContextHolderAwareRequestWrapper[ FirewalledRequest[ org.apache.catalina.core.ApplicationHttpRequest@2d44adc5]] using org.springframework.security.authorization.AuthenticatedAuthorizationManager@20ec6fdd
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.context.HttpSessionSecurityContextRepository – Did not find SecurityContext in HttpSession 96FED99CA7077F197D1F9684BA982785 using the SPRING_SECURITY_CONTEXT session attribute
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.context.SupplierDeferredSecurityContext – Created SecurityContextImpl [Null authentication]
21:12:10.951 [http-nio-8082-exec-5] TRACE org.springframework.security.web.authentication.AnonymousAuthenticationFilter – Did not set SecurityContextHolder since already authenticated UsernamePasswordAuthenticationToken [Principal=Y_SALDAMLI, Credentials=[PROTECTED], Authenticated=true, Details=null, Granted Authorities=[ROLE_ADMIN, ROLE_TEST, ROLE_USER]]
21:12:10.951 [http-nio-8082-exec-5] DEBUG org.springframework.security.web.FilterChainProxy – Secured GET /error

Spring boot Security redirects to /error path for every endoints except the /actuator.

Thiết kế website giá rẻ

Danh mục

What is the reason Spring Security redirecting to /error in this case?