Spring Webflux disabling login

user_9597039 0
Viewed 1276

Let me shortly describe what problem i am facing right now.

I have configured spring security for webflux application, and i am getting login form prompted, when i try to access the route that doesn't require authentication. The route is /swagger-ui/ and it should get opened without any login forms or whatever.

Below is the code i have within the SecurityWebFilterChain


@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
    //@formatter:off
    return http
            .formLogin().disable()
            .httpBasic().disable()
            .authenticationManager(authenticationManager)
            .securityContextRepository(securityContextRepository)
            .authorizeExchange()
            .pathMatchers(HttpMethod.OPTIONS).permitAll()
            .pathMatchers("/v2/api-docs", "/v3/api-docs", "/configuration/ui", "/swagger-resources",
                    "/configuration/security", "/swagger-ui/", "/swagge‌​r-ui",
                    "/webjars/**", "/swagger-resources/configuration/ui",
                    "/swagger-resources/configuration/security").permitAll()  // Allowed routes for swagger
            .pathMatchers("/api/auth", "/api/auth/**").permitAll() // Allowed routes for auth
            .and()
            .authorizeExchange()
            .anyExchange()
            .authenticated() // All other routes require authentication
            .and()
            .csrf().disable()
            .headers()
            .hsts()
            .includeSubdomains(true)
            .maxAge(Duration.ofSeconds(31536000))
            .and()
            .frameOptions().mode(XFrameOptionsServerHttpHeadersWriter.Mode.SAMEORIGIN)
            .and()
            .build();
    //@formatter:on
    }
}

If anyone has any suggestions, please let me know, i will appreciate it. Here is the picture what i got in the browser.

enter image description here

spring-webflux spring-boot spring-security
1 Answers

I was really annoyed by this issue too. The problem is that by putting .httpBasic().disable() in your code you would expect spring to skip basic authentication (that browser window) but it doesn't.

Instead, try providing a ServerAuthenticationEntryPoint to the .httpBasic().

The most simple one is the HttpStatusServerEntryPoint.

For example in your code change to:

***
return http
            .formLogin().disable()
            .httpBasic().authenticationEntryPoint(new HttpStatusServerEntryPoint(HttpStatus.UNAUTHORIZED))
            .authenticationManager(authenticationManager)
            ***

By changing that your server will return a 401 UNAUTHORIZED HttpStatus instead of that browser window! Cheers!

user_71622510
Related