Setup Spring security to redirect user to login page if not authenticated

Question

I have a Spring boot application with Spring security.

My problem is similar to this one, but in my case I want to redirect the user to the login page if he's not authenticated when he tries to access any page of the application.

The following image shows the architecture of the application:

My config class looks like this:

@EnableWebSecurity
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/**").hasAnyRole("USER")
                .and().formLogin().loginPage("/login").permitAll()
                .and().authorizeRequests().antMatchers("/resources/**").permitAll().anyRequest().permitAll();
    }

    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
    }

}

With this configuration, no resource will be loaded. How can I configure my project to redirect the user to the login page if he's not authenticated and at the same time having my resources folder loaded?

Where is your login page? The screenshot above doesn't show its location in your project. — Kyle Anderson, Oct 02 '18 at 14:16

score 5 · Answer 1 · answered Oct 03 '18 at 08:01

plz checkout configure method

@Override
  public void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
        .antMatchers("/resources/**").permitAll()
        .antMatchers("/login*").permitAll()
        .anyRequest().authenticated()
        .and().formLogin().loginPage("/login");
  }

and implements WebMvcConfigurer Class like below

@Configuration
@EnableWebMvc
public class WebMvcConfiguration implements WebMvcConfigurer {

  @Override
  public void addResourceHandlers(final ResourceHandlerRegistry registry) {
    registry.addResourceHandler("/static/**")
        .addResourceLocations("classpath:/static/");
  }
}

addResourceHandlers means find resources in /static.

The line `http.authorizeRequests().antMatchers("/resources/**").permitAll();` only allows me to access the page at localhost:8080/resources/ without being redirected to the login page. — Jordan Noel, Oct 03 '18 at 12:45

score 1 · Answer 2 · answered Oct 16 '19 at 23:58

1

Spring security is not allowing your css when a "GET" request to it is made allow it by changing the following line to the next line

this line = .antMatchers("/*.js").permitAll()

this line = .antMatchers("/*.js", "/*.css").permitAll()

answered Oct 16 '19 at 23:58

Ahren Swett

11
1

Alien · Answer 3 · 2018-10-02T14:36:51.580

0

Update your method by using authenticated() like below.

@Override
        protected void configure(HttpSecurity http) throws Exception {
            http
              .authorizeRequests()
              .antMatchers("/login*").
              .antMatchers("/resources/**").permitAll()
              .antMatchers("/*.js").permitAll()
              .permitAll()
              .anyRequest()
              .authenticated()
              .and()
              .formLogin();
        }

Refer this article

edited Oct 02 '18 at 14:36

answered Oct 02 '18 at 14:16

Alien

15,141
6
37
57

This allows me, indeed to redirect my user to the login page, but it still doesn't load the css files in the `ressources` folder... – Jordan Noel Oct 02 '18 at 14:28
updated the answer..pls check once added .antMatchers("/resources/**").permitAll() .antMatchers("/*.js").permitAll() – Alien Oct 02 '18 at 14:37

M.Minbashi · Answer 4 · 2021-09-30T15:29:06.103

0

I had this problem in my login page before authentication, I found it and resolved my problem by overrode this method in SecurityConfig

  @Override
  public void configure(WebSecurity web) {
     web.ignoring().antMatchers("/resources/**");
  }

afterward login page knew .js and .css

edited Sep 30 '21 at 15:29

answered Sep 30 '21 at 12:11

M.Minbashi

244
1
3
12

Setup Spring security to redirect user to login page if not authenticated

4 Answers4

Linked