Redirecting to original URL for stateless session

user_248521 0
Viewed 1018

I am trying to create stateless security whereby a JWT token is stored in the Cookie instead of the SESSION.

The problem is that without a session the SavedRequestAwareAuthenticationSuccessHandler is not aware of the original request (before the authentication page pops up). So at line 77 here savedRequest is null.

This seems weird and I guess I am doing something wrong. How do I allow the page to redirect to the original URL requested after login for a stateless session?

  1. I disable Sessions

        @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)

       ....formLogin().loginPage("/login").permitAll().successHandler(authenticationSuccessHandler)

    }

  2. I then make a custom AuthenticationSuccessHandler which extends SavedRequestAwareAuthenticationSuccessHandler. I register this as the successHandler (above).

     @Component
 public class JwtCookieAuthenticationSuccessHandler extends 
          SavedRequestAwareAuthenticationSuccessHandler {
    @Override
    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication)
            throws IOException, ServletException {

        Cookie cookie = ... CREATE A COOKIE WITH A JWT

        response.addCookie(cookie);

        super.onAuthenticationSuccess(request, response, authentication);
    }

}

EDIT: This are my dependencies:

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-dependencies</artifactId>
        <version>1.5.2.RELEASE</version>
        <type>pom</type>
        <scope>import</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-test</artifactId>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.security.oauth</groupId>
        <artifactId>spring-security-oauth2</artifactId>
    </dependency>
</dependencies>
spring-security
1 Answers

In your configure, add :

.requestCache().requestCache(new CookieRequestCache())

Full exemple :

   protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().csrfTokenRepository(new CookieCsrfTokenRepository())
                .and()
                .authorizeRequests()
                .antMatchers("/about").permitAll()
                .antMatchers("/accounts").hasRole("ADMINISTRATOR")
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
                .requestCache().requestCache(new CookieRequestCache())
                .and()
                .logout()
                .permitAll()
                .and()
                .sessionManagement()
                .maximumSessions(1)
                .sessionRegistry(sessionRegistry())
                .and()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .securityContext()
                .securityContextRepository(securityContextRepository);
user_147582470
Related