I'm using Spring Boot, Spring Security, Spring Data REST, Hibernate. I'm creating a REST API server.
I configured security to access my REST API as:
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
@CrossOrigin(origins = "*")
public class WebSecurityConfiguration extends WebSecurityConfigurerAdapter {
@Autowired
private UserDetailsServiceImpl userDetailsService;
@Autowired
private TenantFilter tenantFilter;
@Autowired
public void configureAuthentication(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
authenticationManagerBuilder.userDetailsService(this.userDetailsService).passwordEncoder(User.PASSWORD_ENCODER);
}
@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Bean
public JwtAuthenticationTokenFilter jwtTokenFilter() throws Exception {
return new JwtAuthenticationTokenFilter();
}
@Bean
public CookieAuthFilter cookieAuthFilter() throws Exception {
return new CookieAuthFilter();
}
@Bean
public CustomWebAuthenticationDetailsSource customWebAuthenticationDetailsSource() {
return new CustomWebAuthenticationDetailsSource();
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
//********************************************************************
// PERMIT OPTIONS
//********************************************************************
.antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
//********************************************************************
//WEBSOCKET
//********************************************************************
.antMatchers("/socket/**").permitAll()
.antMatchers("/images/**").permitAll()
.antMatchers("/resources/templates/**").permitAll()
.antMatchers("/api/v1/notifications/**").permitAll()
//********************************************************************
// SWAGGER
//********************************************************************
.antMatchers("/v2/api-docs", "/swagger-accounts/configuration/ui", "/swagger-accounts", "/swagger-accounts/configuration/security",
"/swagger-ui.html", "/webjars/**", "/swagger-resources/**").permitAll()
.antMatchers("/api/v1/").permitAll()
.antMatchers("/api/v1/auth/**").permitAll()
.antMatchers("/api/v1/formLogin/**").permitAll()
.antMatchers("/api/v1/logout").permitAll()
.antMatchers("/api/v1/agents/verifyEmail").permitAll()
.antMatchers("/api/v1/agents/**/verificationToken").permitAll()
.antMatchers("/api/v1/agents/**/resetPassword").permitAll()
.antMatchers("/api/v1/agents/**/verifyPasswordReset").permitAll()
.antMatchers("/api/v1/agents/**/changePassword").permitAll()
.antMatchers("/api/v1/errors/**").permitAll()
.antMatchers("/api/v1/verifyCaptcha").permitAll()
.antMatchers("/api/v1/ping").permitAll()
.antMatchers("/api/v1/tenants/**").permitAll()
// all other endpoints are authenticated
.antMatchers("/**").authenticated()
// global settings
.and()
.csrf()
.disable();
http.formLogin().loginPage("/login").permitAll();
// Custom JWT based security filter
http.addFilterBefore(tenantFilter, UsernamePasswordAuthenticationFilter.class);
http.addFilterBefore(jwtTokenFilter(), UsernamePasswordAuthenticationFilter.class);
http.addFilterBefore(cookieAuthFilter(), UsernamePasswordAuthenticationFilter.class);
http.headers().cacheControl().disable();
}
}
The goal I want to get is:
show a form login when the user try to access to the url like http://myhost/swagger-ui.html#/ in order to be able to use swagger easily
avoid form login when the server is called with a REST call (through Angular or Postman or whatever). In fact, otherwise if the auth fails, the server replies with the html code of the login page
is there a way to accomplish this with Spring, without turning off formLogin()?