Spring Boot register with JWT

Question

I am currently working on a Spring project, where I got the Security already implemented.(University) But I occurred the following problem: If I want to register a new user to the system, I logically do not have a JWT to authenticate the new user. I just get Invalid authorization header or token back from Spring, if I try to register a new user. So, I think the Security is not right configured:


@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    private final UserService userService;
    private final PasswordEncoder passwordEncoder;
    private final RequestMatcher whiteListedRequests;
    private final SecurityProperties securityProperties;
    private final JwtTokenizer jwtTokenizer;

    @Autowired
    public SecurityConfig(UserService userService,
                          PasswordEncoder passwordEncoder,
                          SecurityProperties securityProperties, JwtTokenizer jwtTokenizer) {
        this.userService = userService;
        this.securityProperties = securityProperties;
        this.passwordEncoder = passwordEncoder;
        this.jwtTokenizer = jwtTokenizer;

        this.whiteListedRequests = new OrRequestMatcher(securityProperties.getWhiteList().stream()
            .map(AntPathRequestMatcher::new)
            .collect(Collectors.toList()));
    }

   @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.cors().and()
            .csrf()
            .disable();
        http.sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .authorizeRequests()
            .antMatchers("/api/v1/users/sign-up")
            .permitAll();
        http.authorizeRequests().anyRequest()
            .authenticated();
        http.addFilter(new JwtAuthenticationFilter(authenticationManager(), securityProperties, jwtTokenizer));
        http.addFilter(new JwtAuthorizationFilter(authenticationManager(), securityProperties));
}

    @Override
    public void configure(WebSecurity web) {
        web.ignoring().requestMatchers(whiteListedRequests);
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userService).passwordEncoder(passwordEncoder);
    }

    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        final List permitAll = Collections.unmodifiableList(Collections.singletonList("*"));
        final List permitMethods = List.of(HttpMethod.GET.name(), HttpMethod.POST.name(), HttpMethod.PUT.name(),
            HttpMethod.PATCH.name(), HttpMethod.DELETE.name(), HttpMethod.OPTIONS.name(), HttpMethod.HEAD.name(),
            HttpMethod.TRACE.name());
        final CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedHeaders(permitAll);
        configuration.setAllowedOrigins(permitAll);
        configuration.setAllowedMethods(permitMethods);
        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

Does anyone has a tip, how I can change the securityconfig, that a user can register himself against my Endpoint? (/api/v1/users/sign-up) I am kind of lost at this, and trying for several hours to manage the wanted behavior! Thanks in Advance!

EDIT:

I just figured that my application.yml holds a whitelist:

security:
  auth:
    header: Authorization
    prefix: "Bearer "
    login-uri: /api/v1/authentication
    white-list:
      # Browser requests
      - /
      - /favicon.ico
      - /csrf
      - /v2/api-docs
      - /swagger-resources/**
      - /webjars/**
      - /swagger-ui.html
      # H2
      - /h2-console/**
      # Registration
      - /api/v1/registrations/

If I add the URI here, it works properly. But is there a solution to just add it via Code?

user_8400493 · Answer

the registration uri must not request a token, it must be allowed access from the outside.

it must be enabled at the antMatcher

Here is an exemple

@Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf()
            .disable();
        http.sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .authorizeRequests()
            .antMatchers("/regitration/**")
            .permitAll();
        http.authorizeRequests().anyRequest()
            .authenticated();
        http.addFilter(new JWTAuthenticationFilter(authenticationManager(),userRepository,iLdapService,cryptoHelper));
        http.addFilterBefore(new JWTAutorizationFilter(),UsernamePasswordAuthenticationFilter.class);
    }

Spring Boot register with JWT

1 Answers