Micronaut Framework / Logged in but unauthorized

user_10552571 0
Viewed 1439

I am encountering a problem in my micronaut app. If I want to visit '/index', I have to login. When I'am logged in the '/index' page is correctly displayed. At this very moment if I want to visit the '/periods/list/my' I'am redirirect to the 'unauthorized-target-url'

The strangest thing is that visiting '/index' is still ok... Could this be a security configuration problem ?

HomeController.java

@Secured(SecurityRule.IS_ANONYMOUS)
@Controller("/")
public class HomeController {
    @Get("/")
    @View("index")
    @Secured(SecurityRule.IS_AUTHENTICATED)
    Map<String, Object> index(@Nullable Principal principal) {
       ...
    }
}

PeriodController.java

@Controller("/periods")
@Secured(SecurityRule.IS_ANONYMOUS)
public class PeriodController {
    @Get("/list/my")
    @View("periods/my")
    @Secured(SecurityRule.IS_AUTHENTICATED)
    Map<String, Object> myPeriods(@Nullable Principal principal) {
        ...
    }
}

application.yml 

micronaut:
    application:
        name: ws
    security:
        enabled: true
        endpoints:
            login:
                enabled: true 
            logout:
                enabled: true
                path: '/logout'
        interceptUrlMap:
            -
                pattern: /public/**
                httpMethod: GET
                access:
                    - isAnonymous()
        session:
            enabled: true 
            login-success-target-url: '/'
            login-failure-target-url: '/login/authFailed'
            logout-target-url: '/'
            unauthorized-target-url: '/unauthorized'
            forbidden-target-url: '/forbidden'
    session:
        http:
            cookie: true
            header: false

logs

11:47:20.134 [nioEventLoopGroup-1-4] DEBUG i.m.h.server.netty.NettyHttpServer - Server localhost:8080 Received Request: GET /periods/list/my
11:47:20.134 [nioEventLoopGroup-1-4] DEBUG i.m.h.s.netty.RoutingInBoundHandler - Matching route GET - /periods/list/my
11:47:20.134 [nioEventLoopGroup-1-4] DEBUG i.m.h.s.netty.RoutingInBoundHandler - Matched route GET - /periods/list/my to controller class com.gvhr.controllers.PeriodController
11:47:20.135 [pool-1-thread-4] DEBUG i.m.s.t.reader.HttpHeaderTokenReader - Looking for bearer token in Authorization header
11:47:20.135 [pool-1-thread-4] DEBUG i.m.s.t.TokenAuthenticationFetcher - Unauthenticated request GET, /periods/list/my, no token found.
11:47:20.135 [pool-1-thread-4] DEBUG i.m.security.filters.SecurityFilter - Failure to authenticate request. GET /periods/list/my.
11:47:20.135 [pool-1-thread-4] DEBUG i.m.security.filters.SecurityFilter - Unauthorized request GET /periods/list/my. The rule provider io.micronaut.security.rules.SecuredAnnotationRule rejected the request.
11:47:20.149 [nioEventLoopGroup-1-5] DEBUG i.m.h.server.netty.NettyHttpServer - Server localhost:8080 Received Request: GET /unauthorized
11:47:20.149 [nioEventLoopGroup-1-5] DEBUG i.m.h.s.netty.RoutingInBoundHandler - Matching route GET - /unauthorized
11:47:20.149 [nioEventLoopGroup-1-5] DEBUG i.m.h.s.netty.RoutingInBoundHandler - Matched route GET - /unauthorized to controller class com.gvhr.controllers.HomeController
micronaut
2 Answers

I don't know if this is root cause of your problem, but I had similar symptoms. The cookie use was unpredictable. Sometimes, the cookie would work on a path and then fail on another path. Very random.

I found the problem: Each page/path sent back a cookie with a different path. This means the pages '/' and '/test' each had a cookie. When you re-visited the pages, the browser would send one cookie for page '/', but two cookies for '/test'.

The fix, in your application.yml, make sure the cookiePath is set:

micronaut:
  session:
    http:
      cookiePath: /

This forces just one SESSION cookie for the whole server.

I will probably update this when I log a change request.

I also replaced (@Replaces) two Micronaut beans: SessionSecurityfilterRejectionHandler and SessionLoginHandler to support automatic re-direction to the original page after login.

I get the feeling that Micronaut is not yet focused on the HTML/User interaction yet :).

user_56608200

Issue fixed in Micronaut version 1.1.1

user_63858450
Related