.png)
Spring-Security: Different AuthenticationEntryPoint for API vs webpage
This is just a real quick post, on a little bit of Spring that I came across today. It's a very simple thing, but, in my opinion, beautiful in it's simplicity.I found myself working on some Spring-Security stuff, and an app where I needed to define my AuthenticationEntryPoint (I am in the process of adding the security stuff, so this is not done yet). Simple enough - normally in config you can just add it to the exception handling setup. However, this time I wanted to define two different entry points: one for when a user attempts to access an API (JSON) and one for normal site pages.
It's not unusual to have an API baked into an app (maybe under /api/** etc), and the ideal behaviour would be to return an appropriate HTTP Status code for the API (401) plus a JSON payload, and for a logged in web page the user would be bounced to the login page before continuing.
Having dealt with this split for error handling, controller routing and security elsewhere, I assumed I would have to implement a custom AuthenticationEntryPoint, chuck in a fer IF statements checking the logged in user and requested URL and either redirect or respond with the status appropriately. However, Spring has us covered with its DelegatingAuthenticationEntryPoint - which is what it sounds like, and super simple to use. Probably best demonstrated with the code (because it's just that simple!)
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| @Override protected void configure(HttpSecurity http) throws Exception { | |
| //normal config stuff etc.. | |
| //Setup entry point (e.g. where should a user be sent if accessing logged in only URL whilst not logged in) | |
| http.exceptionHandling().authenticationEntryPoint( delegatingAuthenticationEntryPoint() ) | |
| } | |
| @Bean public DelegatingAuthenticationEntryPoint delegatingAuthenticationEntryPoint(){ | |
| DelegatingAuthenticationEntryPoint entryPoint = new DelegatingAuthenticationEntryPoint( [ (new AntPathRequestMatcher( "/api/**" ))) : new HttpStatusEntryPoint( HttpStatus.UNAUTHORIZED ) ] ) | |
| entryPoint.defaultEntryPoint = new LoginUrlAuthenticationEntryPoint( "/" ) | |
| entryPoint | |
| } |
This genuinely elicited an "awww yeah" from me.
0 comments: