Disable Spring Security for OPTIONS Http Method

Question

Is it possible to disable Spring Security for a type of HTTP Method?

We have a Spring REST application with services that require Authorization token to be attached in the header of http request. I am writing a JS client for it and using JQuery to send the GET/POST requests. The application is CORS enabled with this filter code.

doFilter(....) {

  HttpServletResponse httpResp = (HttpServletResponse) response;
  httpResp.setHeader("Access-Control-Allow-Origin", "*");
  httpResp.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE");
  httpResp.setHeader("Access-Control-Max-Age", "3600");
  Enumeration<String> headersEnum = ((HttpServletRequest) request).getHeaders("Access-Control-Request-Headers");
  StringBuilder headers = new StringBuilder();
  String delim = "";
  while (headersEnum.hasMoreElements()) {
    headers.append(delim).append(headersEnum.nextElement());
    delim = ", ";
  }
  httpResp.setHeader("Access-Control-Allow-Headers", headers.toString());
}

But when JQuery sends in the OPTIONS request for CORS, the server responds with Authorization Failed token. Clearly the OPTIONS request, lacks Authorization token. So is it possible to let the OPTIONS escape the Security Layer from the Spring Security Configuration?

score 150 · Answer 1 · edited Dec 20 '18 at 14:01

150

If you're using an annotation based security config file (@EnableWebSecurity & @Configuration) you can do something like the following in the configure() method to allow for the OPTION requests to be permitted by Spring Security without authentication for a given path:

@Override
protected void configure(HttpSecurity http) throws Exception
{
     http
    .csrf().disable()
    .authorizeRequests()
      .antMatchers(HttpMethod.OPTIONS,"/path/to/allow").permitAll()//allow CORS option calls
      .antMatchers("/resources/**").permitAll()
      .anyRequest().authenticated()
    .and()
    .formLogin()
    .and()
    .httpBasic();
}

edited Dec 20 '18 at 14:01

Daniel Gray

1,697
1
21
41

answered Nov 10 '14 at 16:45

Felby

4,045
4
26
23

4

+1 Exactly what we did to enable CORS OPTIONS requests. – Dormouse Nov 12 '14 at 10:15
it's works fine Thanks for your tips i searching and debug lot but can't fixed now i fixed it to use this tips – Saurav Wahid Jan 20 '16 at 09:38
I found your answer while researching a similar problem which does not yet respond to your solution in its present form. Are you willing to take a look? Here is the link: http://stackoverflow.com/questions/36705874/request-options-logout-doesnt-match-post-logout – CodeMed Apr 18 '16 at 23:40
This might help for a general understanding: http://docs.spring.io/spring-security/site/docs/4.1.3.RELEASE/reference/htmlsingle/#multiple-httpsecurity – Dr4gon Oct 09 '16 at 22:31
I am not Java Spring user myself, I am having same issue on my end using different language on backend. Does Java/Spring bring any additional abstraction in security or it is mostly safe to ignore authentication middleware method for all OPTIONS requests? – Kunok Jan 24 '18 at 00:11
Not working for me. Here is my problem, could you please have a look. – dnvsp May 29 '18 at 11:30
https://stackoverflow.com/questions/50579277/no-access-control-allow-origin-header-is-present-on-the-requested-resource-th – dnvsp May 29 '18 at 11:30
That works for me. Remember the difference from one asterisk and double asterisk regards to paths. antMatchers(HttpMethod.OPTIONS,"/rest/auth/**").permitAll() https://stackoverflow.com/questions/12569308/spring-difference-of-and-with-regards-to-paths – Angelo Aug 06 '18 at 09:16
In order to open a POST endpoint for client requests it is available the following security configuration: .antMatchers(HttpMethod.POST,"/path/to/post/request") – Oleksii Kyslytsyn May 10 '19 at 16:04
This is not recommended and don't do this. – wonsuc Feb 03 '21 at 02:16
Simple solution in spring security just add http.cors(). You are done. – singhpradeep Mar 01 '22 at 01:27

score 51 · Answer 2 · answered Sep 22 '15 at 17:10

51

Allow all OPTIONS in context:

    @Override
    public void configure(WebSecurity web) throws Exception {
        web.ignoring().antMatchers(HttpMethod.OPTIONS, "/**");
    }

answered Sep 22 '15 at 17:10

Luc S.

1,144
10
7

3

This seemed to be the only way to allow OPTIONS requests without requiring auhorization. – jaseeey Feb 24 '16 at 03:50
If you then create an Options endpoint you want to secure, you'll forget about the exclusion in your config and everyone can access it. You should consider using the filter to allow cors option requests to be excluded from spring-security: https://docs.spring.io/spring-security/site/docs/4.2.x/reference/html/cors.html – Tim Feb 07 '18 at 15:39
1

With HttpSecurity is http.authorizeRequests() .antMatchers(HttpMethod.OPTIONS, "/registrybrain/**").permitAll() – Ena Apr 20 '18 at 09:28
Spent more than 2 hours trying and finding solution- only this worked. – Waqas Aug 19 '18 at 12:58
1

"If you then create an Options endpoint you want to secure" @Tim why would anyone need that? – Maksim Gumerov Jan 29 '19 at 11:37
Dude you saved me. Thanks a ton – Mukarram Ali Mar 04 '19 at 06:04

score 10 · Accepted Answer · answered Feb 11 '14 at 08:32

10

Have you tried this

You can use multiple elements to define different access requirements for different sets of URLs, but they will be evaluated in the order listed and the first match will be used. So you must put the most specific matches at the top. You can also add a method attribute to limit the match to a particular HTTP method (GET, POST, PUT etc.).

<http auto-config="true">
    <intercept-url pattern="/client/edit" access="isAuthenticated" method="GET" />
    <intercept-url pattern="/client/edit" access="hasRole('EDITOR')" method="POST" />
</http>

Above means you need to select the url pattern to intercept and what methods you want

answered Feb 11 '14 at 08:32

Koitoer

18,778
7
63
86

But I guess we cant have some thing like `` . Right ? – Dhanush Gopinath Feb 11 '14 at 08:42
According to http://www.springframework.org/schema/security/spring-security-3.1.xsd, I dont think so – Koitoer Feb 11 '14 at 08:51
1

How would this work in case of @PreAuthorize annotation, I want Put methods to have Admin access and Post methods to have User access – Dipanshu Verma Nov 07 '15 at 16:27
1

What will be it's equivalent in java config – Ravi Kumar Dec 05 '15 at 05:51
please have a look on my problem. https://stackoverflow.com/questions/50579277/no-access-control-allow-origin-header-is-present-on-the-requested-resource-th – dnvsp May 29 '18 at 11:32

wonsuc · Answer 4 · 2023-03-06T00:36:24.193

The accepted answer is not recommended and you shold not do that.
Below is the correct way for CORS setup of Spring Security and jQuery's ajax.

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
   
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(userAuthenticationProvider);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .cors() // <-- This let it use "corsConfigurationSource" bean.
                .and()
            .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            ...
    }

    @Bean
    protected CorsConfigurationSource corsConfigurationSource() {
        final CorsConfiguration configuration = new CorsConfiguration();

        configuration.setAllowedOrigins(Collections.singletonList("http://localhost:3000"));
        configuration.setAllowedMethods(Arrays.asList("HEAD", "GET", "POST", "PUT", "DELETE", "PATCH"));

        // NOTE: setAllowCredentials(true) is important,
        // otherwise, the value of the 'Access-Control-Allow-Origin' header in the response
        // must not be the wildcard '*' when the request's credentials mode is 'include'.
        configuration.setAllowCredentials(true);

        // NOTE: setAllowedHeaders is important!
        // Without it, OPTIONS preflight request will fail with 403 Invalid CORS request
        configuration.setAllowedHeaders(Arrays.asList(
                "Authorization",
                "Accept",
                "Cache-Control",
                "Content-Type",
                "Origin",
                "x-csrf-token",
                "x-requested-with"
        ));

        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
}

And from jQuery side.

$.ajaxSetup({
    // NOTE: Necessary for CORS
    crossDomain: true,
    xhrFields: {
        withCredentials: true
    }
});

Dennis Kieselhorst · Answer 5 · 2017-07-11T09:16:04.617

3

In case someone is looking for an easy solution using Spring Boot. Just add an additional bean:

   @Bean
   public IgnoredRequestCustomizer optionsIgnoredRequestsCustomizer() {
      return configurer -> {
         List<RequestMatcher> matchers = new ArrayList<>();
         matchers.add(new AntPathRequestMatcher("/**", "OPTIONS"));
         configurer.requestMatchers(new OrRequestMatcher(matchers));
      };
   }

Please note that depending on your application this may open it for potential exploits.

Opened issue for a better solution: https://github.com/spring-projects/spring-security/issues/4448

edited Jul 11 '17 at 09:16

answered Jul 10 '17 at 12:33

Dennis Kieselhorst

1,280
1
13
23

`IgnoredRequestCustomizer` is deprecated since spring boot 2. – bvdb Jun 22 '20 at 15:48

score 0 · Answer 6 · answered May 16 '20 at 13:02

If you're using annotation-based security config then you should add spring's CorsFilter to the application context by calling .cors() in your config, something like this:

@Override
protected void configure(HttpSecurity http) throws Exception
{
     http
    .csrf().disable()
    .authorizeRequests()
      .antMatchers("/resources/**").permitAll()
      .anyRequest().authenticated()
    .and()
    .formLogin()
    .and()
    .httpBasic()
    .and()
    .cors();
}

score -1 · Answer 7 · answered Feb 12 '19 at 21:57

-1

In some cases, it is needed add configuration.setAllowedHeaders(Arrays.asList("Content-Type")); to corsConfigurationSource() when using WebSecurityConfigurerAdapter to solve the cors problem.

answered Feb 12 '19 at 21:57

FabianoLothor

2,752
4
25
39

Disable Spring Security for OPTIONS Http Method

7 Answers7

Linked

Related