AuthenticationEntryPoint Spring Boot 2

Question

I'm trying to implement custom AuthenticationEntryPoint in Spring Boot 2 in my configure method of WebSecurityConfig.

I've seen a lot of examples like this:

@Component
public class Http401UnauthorizedEntryPoint implements AuthenticationEntryPoint {

private final Logger log = LoggerFactory.getLogger(Http401UnauthorizedEntryPoint.class);

/**
 * Always returns a 401 error code to the client.
 */
@Override
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException arg2) throws IOException,
        ServletException {

    log.debug("Pre-authenticated entry point called. Rejecting access");
    response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Access Denied");
}
}

But I always obtain a 403 instead of 401.

How can I do this in Spring boot 2?

score 5 · Answer 1 · answered Oct 25 '18 at 10:24

Have a look at my answer here: https://stackoverflow.com/a/52986942/3437868 and here: https://stackoverflow.com/a/52986779/3437868

In short: As of Spring Boot 2 class Http401AuthenticationEntryPoint has been removed (see Spring Boot Issue 10725).

Instead of Http401AuthenticationEntryPoint use HttpStatusEntryPoint with HttpStatus.UNAUTHORIZED:

http.exceptionHandling()
    .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED));

AokoQin · Answer 2 · 2018-11-01T02:28:51.533

I'm using Spring boot 1.5,maybe it's not suitable for this case,but i still hope this could help you.

After you created your Http401UnauthorizedEntryPoint bean, you should configure it into Spring Security.

@Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .antMatchers("/api/login").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin().disable()
                .httpBasic().disable()
                .logout().disable()
                .csrf().disable()

                // look here,bro
                .exceptionHandling()
                .authenticationEntryPoint(new Http401AuthenticationEntryPoint(""))
        ;
    }

Then the entry point should work.

In fact, Spring has already offered you lots of entry point beans.Just like "Http401AuthenticationEntryPoint" that also can solve this case instant of creating a bean by yourself.

score 0 · Answer 3 · answered Oct 29 '18 at 09:44

You create a class extends WebSecurityConfigurerAdapter. Then you autowired Http401UnauthorizedEntryPoint class which you implement from AuthenticationEntryPoint. You can refer below:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Autowired
    private Http401UnauthorizedEntryPoint authenticationEntryPoint;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .exceptionHandling()
                .authenticationEntryPoint(authenticationEntryPoint)


    }
}

AuthenticationEntryPoint Spring Boot 2

3 Answers3