csrf test

2016-01-23 20:41:42 +02:00
parent 68469975e3
commit 7653328a2a
6 changed files with 171 additions and 1 deletions
@@ -42,7 +42,7 @@ public class SecurityJavaConfig extends WebSecurityConfigurerAdapter {
        .authenticationEntryPoint(restAuthenticationEntryPoint)
        .and()
        .authorizeRequests()
-        .antMatchers("/api/**").authenticated()
+        .antMatchers("/**").authenticated()
        .and()
        .formLogin()
        .successHandler(authenticationSuccessHandler)
@@ -0,0 +1,63 @@
+package org.baeldung.spring;
+
+import org.baeldung.security.MySavedRequestAwareAuthenticationSuccessHandler;
+import org.baeldung.security.RestAuthenticationEntryPoint;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.ComponentScan;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
+
+@Configuration
+@EnableWebSecurity
+@ComponentScan("org.baeldung.security")
+public class SecurityWithCsrfConfig extends WebSecurityConfigurerAdapter {
+
+    @Autowired
+    private RestAuthenticationEntryPoint restAuthenticationEntryPoint;
+
+    @Autowired
+    private MySavedRequestAwareAuthenticationSuccessHandler authenticationSuccessHandler;
+
+    public SecurityWithCsrfConfig() {
+        super();
+    }
+
+    //
+
+    @Override
+    protected void configure(final AuthenticationManagerBuilder auth) throws Exception {
+        auth.inMemoryAuthentication().withUser("temporary").password("temporary").roles("ADMIN").and().withUser("user").password("userPass").roles("USER");
+    }
+
+    @Override
+    protected void configure(final HttpSecurity http) throws Exception {// @formatter:off
+        http
+        .exceptionHandling()
+        .authenticationEntryPoint(restAuthenticationEntryPoint)
+        .and()
+        .authorizeRequests()
+        .antMatchers("/**").authenticated()
+        .and()
+        .formLogin()
+        .successHandler(authenticationSuccessHandler)
+        .failureHandler(new SimpleUrlAuthenticationFailureHandler())
+        .and()
+        .logout();
+    } // @formatter:on
+
+    @Bean
+    public MySavedRequestAwareAuthenticationSuccessHandler mySuccessHandler() {
+        return new MySavedRequestAwareAuthenticationSuccessHandler();
+    }
+
+    @Bean
+    public SimpleUrlAuthenticationFailureHandler myFailureHandler() {
+        return new SimpleUrlAuthenticationFailureHandler();
+    }
+
+}