webFlux application returns 404 on any request

Daniil Panyushin 0
Viewed 17

WebFlux returns 404 on any request, no matter if you are authorized or not. In my application I'm not using users, but I have tokens, representing their authentication. If token is valid if give access.

Controller:

@RestController
@RequestMapping("api/token")
public class TokenController {

    @GetMapping("")
    public Mono<ServerResponse> helloWorld() {
        return ServerResponse.ok().bodyValue("Hello world!");
    }

}

SecupityConfigure:


@EnableWebFluxSecurity
public class SecurityConfiguration {

    @Bean
    public BCryptPasswordEncoder bCryptPasswordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public SecurityWebFilterChain springSecurityFilterChain(
            ServerHttpSecurity http,
            JwtAuthenticationConverter converter,
            JwtAuthenticationManager manager
    ) {

        AuthenticationWebFilter filter = new AuthenticationWebFilter(manager);

        filter.setServerAuthenticationConverter(converter);

        return http
                .httpBasic().disable()
                .csrf().disable()
                .cors().disable()
                .formLogin().disable()
                .exceptionHandling()
                .authenticationEntryPoint(
                        (swe, e) ->
                                Mono.fromRunnable(
                                        () -> swe.getResponse().setStatusCode(HttpStatus.UNAUTHORIZED)
                                )
                )
                .accessDeniedHandler(
                        (swe, e) ->
                                Mono.fromRunnable(
                                        () -> swe.getResponse().setStatusCode(HttpStatus.FORBIDDEN)
                                )
                )
                .and()
                    .authorizeExchange()
                        .pathMatchers("api/token*").permitAll()
                    .anyExchange().authenticated()
                .and()
                .addFilterAt(filter, SecurityWebFiltersOrder.AUTHENTICATION)
                .build();
    }

}

JwtAuthenticationManager, JwtAuthenticationProvider and JwtAuthenticationConverter working fine.

spring-webflux spring-security java
2 Answers

Your configuration does not have a place where you require authorization nor allow any calls without authorization.

I believe you need to have sections like this:

.and()
.authorizeRequests()

or/and

.antMatchers("/actuator/**").permitAll()
.and()

in your springSecurityFilterChain.

Please, also consider allowing everything and then adding security configuration step by step.

Igor Kanshyn0

Have you checked that the route mapping is being done correctly and that you are calling the right endpoint?

vabatch_dev0
Related