0

I've read in the following posts ...

... that in the case of forwarding to a Spring secured Url it's necessary to define the following (in order that the Url is restricted for this special case):

  • Define for springSecurityFilterChain not only DispatcherType.REQUEST but also DispatcherType.FORWARD
  • Define once-per-request = false

My question:
Is this only necessary for Security Namespace Configuration or also for Method Security?

I'm asking this, because in the moment my Spring MVC Controllers are secured by Method Security (@PreAuthorize for methods with @RequestMapping) and I've not added these additional configurations. Nevertheless when I try it out, access for forwarded unauthorized users is restricted for these methods and the login page is displayed.

Some additional information:
I'm registering springSecurityFilterChain via the following classes:

public class MySecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {
}

and

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class MySecurityConfig extends WebSecurityConfigurerAdapter {
    ... do some configurations ...
}

I'm using Apache Tomcat Version 7.0.56.

Community
  • 1
  • 1
olivmir
  • 692
  • 10
  • 29
  • I've already tried it out and it works without these configurations. But the other posts are stating, that you have to do these additional configurations, otherwise security does not work for forward. Therefore I'm unsure how to proceed and what is the reason, that in my case it works. By the way: The only thing, what is behaving a little bit different to a normal request I've described in [this question](http://stackoverflow.com/q/41678056/7095884). – olivmir Jan 26 '17 at 15:52
  • I'm more puzzled about why you would ever forward to a secured resource before the user is authenticated? – Klaus Groenbaek Jan 26 '17 at 19:23
  • In a legacy system I'm dealing with, there is a central MVC Controller, that is responsible to forward from a unified url (with a variety of query parameters) to a group of other (method secured) Controllers with a variety of non-unified RequestMapping-Urls. – olivmir Jan 27 '17 at 07:01

0 Answers0