Spring Boot 2.0.2 Spring Security how to disable custom Form Login for two endpoints

Question

EDIT:

After several days of trying various Security configuration changes, I punted and put .permitAll() on every endpoint which should authorize/authenticate any request. But even then, although I could freely "browse" any page without authenticating, my device clients were still unable to submit PUT requests to their normal application endpoint.

So now the question is, why can the remote clients successfully submit PUT requests to my app running on the 1.5.4 Spring Boot version but not when "the same app" is running at Spring Boot 2.0.2?

I get a successful "health check" response ("up and running as usual...") when I hit the same "device" endpoint with a GET request from my browser. But the client devices just get ERR_CONNECTION_REFUSED (or similar) when they try to PUT.

/EDIT

This question is related to one I asked about Web Socket migration a couple of days ago, but the web socket part turned out to be a red herring.

The real issue I'm facing is related to Spring Security in SB 2.0.2.

    springBootVersion = '2.0.2.RELEASE'
    springVersion = '5.0.13.RELEASE'
    springSecurityVersion = '5.2.1.RELEASE'

Everything was working the way we needed at SB 1.5.4, but at 2.0.2 I can't seem to restore the necessary behavior. What I need is my custom Form Login applied to all endpoints except /input and /input/auth

This is the only configurer adapter we were using at 1.5.4 (with ACCESS OVERRIDE)

@Configuration
@EnableWebSecurity
//@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
@Order(1)// highest priority
class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    SimpleAuthenticationManager sam;

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        // false means go to original destination page after login success
        boolean alwaysRedirectToSuccessUrl = false;

        http.headers().cacheControl().disable();
        http.headers().frameOptions().sameOrigin();
        http.csrf().ignoringAntMatchers("/input/auth/**");// ignoring WebSocket endpoints (secured by other means)
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.ALWAYS);
        http.authorizeRequests()
            .antMatchers('/widgetInfo/**', '/stats', '/errorCodes').hasAuthority('USER').anyRequest().fullyAuthenticated()
        http.formLogin()
            .loginPage('/widgetInfo/login')
            .loginProcessingUrl("/widgetInfo/fooInfo")
            .defaultSuccessUrl("/widgetInfo/fooInfo", alwaysRedirectToSuccessUrl)
            .failureUrl("/widgetInfo/login?status=LOGIN_FAILURE").permitAll()
    }

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers('/webjars/**', '/static/**', '/css/**', '/js/**', '/input/**');
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.parentAuthenticationManager(sam)
    }
}

The above configuration works in 2.0.2, except that it is not allowing free access to the /input endpoints. After chasing the red herring for a couple of days, and realizing my misunderstanding, I tried adding another much more lenient configurer adapter as more-or-less described at the bottom of this page

@Configuration
@EnableWebSecurity
@Order(11)// lowest priority
class LenientWebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {

        http.csrf().ignoringAntMatchers("/input/auth/**");// ignoring WebSocket endpoints (secured by other means)
        http.authorizeRequests().antMatchers('/input', 'input/auth', '/input/**').permitAll()

    }
}

But it's not working, the /input endpoint is not yet freely accessible. What is the issue?

If I swap the @Order, then nothing goes through my custom Form Login.

can you please try @Override public void configure(WebSecurity web) throws Exception { web.ignoring().antMatchers('/webjars/**', '/static/**', '/css/**', '/js/**', '/**/input/**'); }. — GaneshSreeju, Jan 08 '20 at 19:09
that pattern change did not change the result. the /input endpoint is still not freely accessible — geneSummons, Jan 08 '20 at 20:32

geneSummons · Accepted Answer · 2020-01-14T15:07:21.110

Answering here just to close loop for future users who might land here.

The problem turned out to be that Spring Boot 1.5.4 would accept "HTTP1.1" requests, but Spring Boot 2.0.2 will not.

Our app sits behind an F5 device that rejects inbound requests if/when the application "healthcheck" requests fail. This is the "healthcheck" request that was working at 1.5.4

GET /myGateway/input HTTP/1.1\r\n

But at 2.0.2, that request was failing. At 2.0.2 the healthcheck request needs to be

GET /myGateway/input \r\n

Therefore, "Spring Security" configuration issues were also a red herring.

EDIT: Apparently, this is/was a known issue with 2.0.x that was fixed in Spring Boot 2.2.x (summer 2019)

Spring Boot 2.0.2 Spring Security how to disable custom Form Login for two endpoints

1 Answers1