enable h2 console with Spring Security

Question

I want to use the h2-console in my Spring Boot project with Spring Security enabled. My Config looks like the following, but i cannot reach any of the unauthenticated paths. If i open the console path the Loginprompt apears.

Is there something in the wrong order?

I've tried it the old way with a WebSecurityConfigurerAdapter and it worked, but i want to use the new stuff.

@EnableWebFluxSecurity
public class SecurityConfiguration {
    @Bean
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {

        return http
                .csrf().disable()
                .headers().frameOptions().disable().and()
                .authorizeExchange()
                .anyExchange().permitAll()
                .and()
                .httpBasic().and()
                .build();
    }
}

I changed the config to the following and the authentication excludes the h2 console like I expected:

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.headers().frameOptions().disable().and()
                .csrf().disable();
        http
                .authorizeRequests()
                .antMatchers("/", "/h2-console/**").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .permitAll()
                .and()
                .logout()
                .permitAll();
    }
}

what happens if you add the following to your security class : .antMatchers("/h2-console/**") or read this : http://appsdeveloperblog.com/add-h2-database-to-spring-boot-project-with-spring-security/ — AchillesVan, Aug 04 '19 at 13:57
Antmatchers only exists in WebSecurityConfigurerAdapter (HttpSecurity), not in WebFlux (ServerHttpSecurity), or did I miss something? — Flip, Aug 04 '19 at 14:24
I tried pathMatcher("/h2-console/**").permitAll(), but that doesn't help. — Flip, Aug 04 '19 at 14:30

score 2 · Accepted Answer · answered Aug 04 '19 at 15:35

2

H2 console seems to only be available on servlet based servers, and webflux is using jetty which is not a servlet based server.

h2 no accessible

answered Aug 04 '19 at 15:35

Toerktumlare

12,548
3
35
54

enable h2 console with Spring Security

1 Answers1