I've read in the following posts ...
- Spring Security Allows Unauthorized User Access to Restricted URL from a Forward
- Answer to "Spring security “forward:” directive can't forward to login form"
- I’m forwarding a request to another URL using the RequestDispatcher, but my security constraints aren’t being applied.
- Class FilterSecurityInterceptor
- Specifying Filter Mappings
... that in the case of forwarding to a Spring secured Url it's necessary to define the following (in order that the Url is restricted for this special case):
- Define for
springSecurityFilterChain
not onlyDispatcherType.REQUEST
but alsoDispatcherType.FORWARD
- Define
once-per-request = false
My question:
Is this only necessary for Security Namespace Configuration or also for Method Security?
I'm asking this, because in the moment my Spring MVC Controllers are secured by Method Security (@PreAuthorize
for methods with @RequestMapping
) and I've not added these additional configurations. Nevertheless when I try it out, access for forwarded unauthorized users is restricted for these methods and the login page is displayed.
Some additional information:
I'm registering springSecurityFilterChain via the following classes:
public class MySecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {
}
and
@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class MySecurityConfig extends WebSecurityConfigurerAdapter {
... do some configurations ...
}
I'm using Apache Tomcat Version 7.0.56.