diff --git a/spring-security-rest/pom.xml b/spring-security-rest/pom.xml index 57ce5ddb92..70967ce214 100644 --- a/spring-security-rest/pom.xml +++ b/spring-security-rest/pom.xml @@ -2,7 +2,6 @@ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> 4.0.0 - com.baeldung spring-security-rest 0.1-SNAPSHOT spring-security-rest @@ -10,9 +9,9 @@ com.baeldung - parent-spring-4 + parent-spring-5 0.0.1-SNAPSHOT - ../parent-spring-4 + ../parent-spring-5 @@ -195,13 +194,6 @@ - - - org.apache.maven.plugins - maven-war-plugin - ${maven-war-plugin.version} - - org.codehaus.cargo cargo-maven2-plugin @@ -282,17 +274,17 @@ - 4.2.6.RELEASE - 0.21.0.RELEASE + 5.1.0.RELEASE + 0.25.0.RELEASE 3.1.0 1.1.0.Final 1.2 - 2.8.5 + 2.9.2 - 19.0 + 26.0-jre 3.5 1.3.2 @@ -303,7 +295,6 @@ 2.9.2 - 2.6 1.6.1 diff --git a/spring-security-rest/src/main/java/org/baeldung/persistence/model/Foo.java b/spring-security-rest/src/main/java/org/baeldung/persistence/model/Foo.java index 1941e2aa51..05a7c7b9a0 100644 --- a/spring-security-rest/src/main/java/org/baeldung/persistence/model/Foo.java +++ b/spring-security-rest/src/main/java/org/baeldung/persistence/model/Foo.java @@ -6,6 +6,8 @@ import javax.validation.constraints.Size; public class Foo implements Serializable { + private static final long serialVersionUID = -5422285893276747592L; + private long id; @Size(min = 5, max = 14) diff --git a/spring-security-rest/src/main/java/org/baeldung/security/MySavedRequestAwareAuthenticationSuccessHandler.java b/spring-security-rest/src/main/java/org/baeldung/security/MySavedRequestAwareAuthenticationSuccessHandler.java index f4b8e7f5ac..6018264632 100644 --- a/spring-security-rest/src/main/java/org/baeldung/security/MySavedRequestAwareAuthenticationSuccessHandler.java +++ b/spring-security-rest/src/main/java/org/baeldung/security/MySavedRequestAwareAuthenticationSuccessHandler.java @@ -11,8 +11,10 @@ import org.springframework.security.web.authentication.SimpleUrlAuthenticationSu import org.springframework.security.web.savedrequest.HttpSessionRequestCache; import org.springframework.security.web.savedrequest.RequestCache; import org.springframework.security.web.savedrequest.SavedRequest; +import org.springframework.stereotype.Component; import org.springframework.util.StringUtils; +@Component public class MySavedRequestAwareAuthenticationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler { private RequestCache requestCache = new HttpSessionRequestCache(); @@ -33,11 +35,6 @@ public class MySavedRequestAwareAuthenticationSuccessHandler extends SimpleUrlAu } clearAuthenticationAttributes(request); - - // Use the DefaultSavedRequest URL - // final String targetUrl = savedRequest.getRedirectUrl(); - // logger.debug("Redirecting to DefaultSavedRequest Url: " + targetUrl); - // getRedirectStrategy().sendRedirect(request, response, targetUrl); } public void setRequestCache(final RequestCache requestCache) { diff --git a/spring-security-rest/src/main/java/org/baeldung/security/RestAuthenticationEntryPoint.java b/spring-security-rest/src/main/java/org/baeldung/security/RestAuthenticationEntryPoint.java index 77aa32ff97..e448e6537f 100644 --- a/spring-security-rest/src/main/java/org/baeldung/security/RestAuthenticationEntryPoint.java +++ b/spring-security-rest/src/main/java/org/baeldung/security/RestAuthenticationEntryPoint.java @@ -16,7 +16,11 @@ import org.springframework.stereotype.Component; public final class RestAuthenticationEntryPoint implements AuthenticationEntryPoint { @Override - public void commence(final HttpServletRequest request, final HttpServletResponse response, final AuthenticationException authException) throws IOException { + public void commence( + final HttpServletRequest request, + final HttpServletResponse response, + final AuthenticationException authException) throws IOException { + response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized"); } diff --git a/spring-security-rest/src/main/java/org/baeldung/spring/ClientWebConfig.java b/spring-security-rest/src/main/java/org/baeldung/spring/ClientWebConfig.java index 601ba66330..8e20358a5a 100644 --- a/spring-security-rest/src/main/java/org/baeldung/spring/ClientWebConfig.java +++ b/spring-security-rest/src/main/java/org/baeldung/spring/ClientWebConfig.java @@ -2,16 +2,9 @@ package org.baeldung.spring; import org.springframework.context.annotation.Configuration; import org.springframework.web.servlet.config.annotation.EnableWebMvc; -import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter; +import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; @EnableWebMvc @Configuration -public class ClientWebConfig extends WebMvcConfigurerAdapter { - - public ClientWebConfig() { - super(); - } - - // API - +public class ClientWebConfig implements WebMvcConfigurer { } \ No newline at end of file diff --git a/spring-security-rest/src/main/java/org/baeldung/spring/SecurityJavaConfig.java b/spring-security-rest/src/main/java/org/baeldung/spring/SecurityJavaConfig.java index c3e738297a..d5111f9b20 100644 --- a/spring-security-rest/src/main/java/org/baeldung/spring/SecurityJavaConfig.java +++ b/spring-security-rest/src/main/java/org/baeldung/spring/SecurityJavaConfig.java @@ -1,6 +1,7 @@ package org.baeldung.spring; import org.baeldung.security.MySavedRequestAwareAuthenticationSuccessHandler; +import org.baeldung.security.RestAuthenticationEntryPoint; import org.baeldung.web.error.CustomAccessDeniedHandler; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; @@ -12,6 +13,8 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.core.context.SecurityContextHolder; +import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; +import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler; @Configuration @@ -20,59 +23,61 @@ import org.springframework.security.web.authentication.SimpleUrlAuthenticationFa @ComponentScan("org.baeldung.security") public class SecurityJavaConfig extends WebSecurityConfigurerAdapter { + @Autowired + private PasswordEncoder encoder; + @Autowired private CustomAccessDeniedHandler accessDeniedHandler; - // @Autowired - // private RestAuthenticationEntryPoint restAuthenticationEntryPoint; + @Autowired + private RestAuthenticationEntryPoint restAuthenticationEntryPoint; - // @Autowired - // private MySavedRequestAwareAuthenticationSuccessHandler authenticationSuccessHandler; + @Autowired + private MySavedRequestAwareAuthenticationSuccessHandler mySuccessHandler; + + private SimpleUrlAuthenticationFailureHandler myFailureHandler = new SimpleUrlAuthenticationFailureHandler(); public SecurityJavaConfig() { super(); SecurityContextHolder.setStrategyName(SecurityContextHolder.MODE_INHERITABLETHREADLOCAL); } - // - @Override protected void configure(final AuthenticationManagerBuilder auth) throws Exception { - auth.inMemoryAuthentication().withUser("temporary").password("temporary").roles("ADMIN").and().withUser("user").password("userPass").roles("USER"); + auth.inMemoryAuthentication() + .withUser("admin").password(encoder.encode("adminPass")).roles("ADMIN") + .and() + .withUser("user").password(encoder.encode("userPass")).roles("USER"); } @Override - protected void configure(final HttpSecurity http) throws Exception {// @formatter:off - http - .csrf().disable() - .authorizeRequests() - .and() - .exceptionHandling().accessDeniedHandler(accessDeniedHandler) - // .authenticationEntryPoint(restAuthenticationEntryPoint) - .and() - .authorizeRequests() - .antMatchers("/api/csrfAttacker*").permitAll() - .antMatchers("/api/customer/**").permitAll() - .antMatchers("/api/foos/**").authenticated() - .antMatchers("/api/async/**").permitAll() - .antMatchers("/api/admin/**").hasRole("ADMIN") - .and() - .httpBasic() -// .and() -// .successHandler(authenticationSuccessHandler) -// .failureHandler(new SimpleUrlAuthenticationFailureHandler()) - .and() - .logout(); - } // @formatter:on - - @Bean - public MySavedRequestAwareAuthenticationSuccessHandler mySuccessHandler() { - return new MySavedRequestAwareAuthenticationSuccessHandler(); + protected void configure(final HttpSecurity http) throws Exception { + http.csrf().disable() + .authorizeRequests() + .and() + .exceptionHandling() + .accessDeniedHandler(accessDeniedHandler) + .authenticationEntryPoint(restAuthenticationEntryPoint) + .and() + .authorizeRequests() + .antMatchers("/api/csrfAttacker*").permitAll() + .antMatchers("/api/customer/**").permitAll() + .antMatchers("/api/foos/**").authenticated() + .antMatchers("/api/async/**").permitAll() + .antMatchers("/api/admin/**").hasRole("ADMIN") + .and() + .formLogin() + .successHandler(mySuccessHandler) + .failureHandler(myFailureHandler) + .and() + .httpBasic() + .and() + .logout(); } - + @Bean - public SimpleUrlAuthenticationFailureHandler myFailureHandler() { - return new SimpleUrlAuthenticationFailureHandler(); + public PasswordEncoder encoder() { + return new BCryptPasswordEncoder(); } } \ No newline at end of file diff --git a/spring-security-rest/src/main/java/org/baeldung/spring/SwaggerConfig.java b/spring-security-rest/src/main/java/org/baeldung/spring/SwaggerConfig.java index bcf6657eee..aa00e8455e 100644 --- a/spring-security-rest/src/main/java/org/baeldung/spring/SwaggerConfig.java +++ b/spring-security-rest/src/main/java/org/baeldung/spring/SwaggerConfig.java @@ -24,8 +24,19 @@ public class SwaggerConfig { @Bean public Docket api() { - return new Docket(DocumentationType.SWAGGER_2).select().apis(RequestHandlerSelectors.basePackage("org.baeldung.web.controller")).paths(PathSelectors.ant("/foos/*")).build().apiInfo(apiInfo()).useDefaultResponseMessages(false) - .globalResponseMessage(RequestMethod.GET, newArrayList(new ResponseMessageBuilder().code(500).message("500 message").responseModel(new ModelRef("Error")).build(), new ResponseMessageBuilder().code(403).message("Forbidden!!!!!").build())); + return new Docket(DocumentationType.SWAGGER_2).select() + .apis(RequestHandlerSelectors.basePackage("org.baeldung.web.controller")) + .paths(PathSelectors.ant("/foos/*")) + .build() + .apiInfo(apiInfo()) + .useDefaultResponseMessages(false) + .globalResponseMessage(RequestMethod.GET, newArrayList(new ResponseMessageBuilder().code(500) + .message("500 message") + .responseModel(new ModelRef("Error")) + .build(), + new ResponseMessageBuilder().code(403) + .message("Forbidden!!!!!") + .build())); } private ApiInfo apiInfo() { diff --git a/spring-security-rest/src/main/java/org/baeldung/spring/WebConfig.java b/spring-security-rest/src/main/java/org/baeldung/spring/WebConfig.java index 92a3c548a2..dba07dc4e5 100644 --- a/spring-security-rest/src/main/java/org/baeldung/spring/WebConfig.java +++ b/spring-security-rest/src/main/java/org/baeldung/spring/WebConfig.java @@ -8,18 +8,14 @@ import org.springframework.web.servlet.ViewResolver; import org.springframework.web.servlet.config.annotation.EnableWebMvc; import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry; import org.springframework.web.servlet.config.annotation.ViewControllerRegistry; -import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter; +import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; import org.springframework.web.servlet.view.InternalResourceViewResolver; @Configuration @ComponentScan("org.baeldung.web") @EnableWebMvc @EnableAsync -public class WebConfig extends WebMvcConfigurerAdapter { - - public WebConfig() { - super(); - } +public class WebConfig implements WebMvcConfigurer { @Override public void addResourceHandlers(final ResourceHandlerRegistry registry) { @@ -38,7 +34,6 @@ public class WebConfig extends WebMvcConfigurerAdapter { @Override public void addViewControllers(final ViewControllerRegistry registry) { - super.addViewControllers(registry); registry.addViewController("/csrfAttacker.html"); } diff --git a/spring-security-rest/src/main/java/org/baeldung/web/controller/AsyncController.java b/spring-security-rest/src/main/java/org/baeldung/web/controller/AsyncController.java index 456eeaaeac..f6f1c392cb 100644 --- a/spring-security-rest/src/main/java/org/baeldung/web/controller/AsyncController.java +++ b/spring-security-rest/src/main/java/org/baeldung/web/controller/AsyncController.java @@ -24,9 +24,9 @@ public class AsyncController { @RequestMapping(method = RequestMethod.GET, value = "/async") @ResponseBody public Object standardProcessing() throws Exception { - log.info("Outside the @Async logic - before the async call: " + SecurityContextHolder.getContext().getAuthentication().getPrincipal()); + log.info("Outside the @Async logic - before the async call: {}", SecurityContextHolder.getContext().getAuthentication().getPrincipal()); asyncService.asyncCall(); - log.info("Inside the @Async logic - after the async call: " + SecurityContextHolder.getContext().getAuthentication().getPrincipal()); + log.info("Inside the @Async logic - after the async call: {}", SecurityContextHolder.getContext().getAuthentication().getPrincipal()); return SecurityContextHolder.getContext().getAuthentication().getPrincipal(); } diff --git a/spring-security-rest/src/main/java/org/baeldung/web/controller/CustomerController.java b/spring-security-rest/src/main/java/org/baeldung/web/controller/CustomerController.java index b8f67960f5..e1db105d18 100644 --- a/spring-security-rest/src/main/java/org/baeldung/web/controller/CustomerController.java +++ b/spring-security-rest/src/main/java/org/baeldung/web/controller/CustomerController.java @@ -48,7 +48,7 @@ public class CustomerController { } Link link =linkTo(methodOn(CustomerController.class).getOrdersForCustomer(customerId)).withSelfRel(); - Resources result = new Resources(orders,link); + Resources result = new Resources<>(orders,link); return result; } @@ -67,7 +67,7 @@ public class CustomerController { } Link link =linkTo(CustomerController.class).withSelfRel(); - Resources result = new Resources(allCustomers,link); + Resources result = new Resources<>(allCustomers,link); return result; } diff --git a/spring-security-rest/src/main/java/org/baeldung/web/controller/FooController.java b/spring-security-rest/src/main/java/org/baeldung/web/controller/FooController.java index 3b9e5d25c0..f914f82215 100644 --- a/spring-security-rest/src/main/java/org/baeldung/web/controller/FooController.java +++ b/spring-security-rest/src/main/java/org/baeldung/web/controller/FooController.java @@ -7,8 +7,6 @@ import java.util.List; import javax.servlet.http.HttpServletResponse; import org.baeldung.persistence.model.Foo; -import org.springframework.beans.factory.annotation.Autowired; -import org.springframework.context.ApplicationEventPublisher; import org.springframework.http.HttpStatus; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.PathVariable; @@ -25,17 +23,9 @@ import com.google.common.collect.Lists; @RequestMapping(value = "/foos") public class FooController { - @Autowired - private ApplicationEventPublisher eventPublisher; - - public FooController() { - super(); - } - // API // read - single - @RequestMapping(value = "/{id}", method = RequestMethod.GET) @ResponseBody public Foo findById(@PathVariable("id") final Long id, final UriComponentsBuilder uriBuilder, final HttpServletResponse response) { @@ -43,7 +33,6 @@ public class FooController { } // read - multiple - @RequestMapping(method = RequestMethod.GET) @ResponseBody public List findAll() { diff --git a/spring-security-rest/src/main/java/org/baeldung/web/service/AsyncServiceImpl.java b/spring-security-rest/src/main/java/org/baeldung/web/service/AsyncServiceImpl.java index caaaa8e0dc..d6d7f53dd7 100644 --- a/spring-security-rest/src/main/java/org/baeldung/web/service/AsyncServiceImpl.java +++ b/spring-security-rest/src/main/java/org/baeldung/web/service/AsyncServiceImpl.java @@ -17,18 +17,18 @@ public class AsyncServiceImpl implements AsyncService { @Async @Override public void asyncCall() { - log.info("Inside the @Async logic: " + SecurityContextHolder.getContext().getAuthentication().getPrincipal()); + log.info("Inside the @Async logic: {}", SecurityContextHolder.getContext().getAuthentication().getPrincipal()); } @Override public Callable checkIfPrincipalPropagated() { Object before = SecurityContextHolder.getContext().getAuthentication().getPrincipal(); - log.info("Before new thread: " + before); + log.info("Before new thread: {}", before); return new Callable() { public Boolean call() throws Exception { Object after = SecurityContextHolder.getContext().getAuthentication().getPrincipal(); - log.info("New thread: " + after); + log.info("New thread: {}", after); return before == after; } }; diff --git a/spring-security-rest/src/main/resources/webSecurityConfig.xml b/spring-security-rest/src/main/resources/webSecurityConfig.xml index 4bb208a195..54bd0f91b9 100644 --- a/spring-security-rest/src/main/resources/webSecurityConfig.xml +++ b/spring-security-rest/src/main/resources/webSecurityConfig.xml @@ -9,6 +9,8 @@ http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.2.xsd"> + + + @@ -44,5 +46,5 @@ - +--> \ No newline at end of file