spring 401

[azure orchid]

Hey, i added to my backend a login system (https://www.youtube.com/watch?v=mn5UZYtPLjg&t=798s) and it gives 401 to everyone if its not valid. In the tutorial it works, but not with me. My code is here: https://github.com/Uzuark/websitebackend

[sharp shadow]

Hey, @azure orchid!
Please remember to /close this post once your question has been answered!

[whole hornet]

Your RequestMapping("/api/v1/users/") should be match with

antMatchers("/auth/**")
                .permitAll()

U are allowing auth path without authentication and authorisation but trying to access other which will result to unauthorised access error

[azure orchid]

i edited it, but now i get from the login method 500 error

[azure orchid]

https://pastebin.com/m6bRaHzC

[sharp shadow]

    @PostMapping("/login")

[azure orchid]

https://github.com/Uzuark/websitebackend/blob/main/src/main/java/de/uzuark/websitebackend/controller/AuthController.java#L53

[sharp shadow]

        Authentication authentication = this.authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(authRequest.getEmail(), authRequest.getPassword()));

[azure orchid]

error line

[lyric sluice]

Maybe missing: SecurityContextHolder.getContext().setAuthentication(authentication); ?

[azure orchid]

where

[lyric sluice]

I think the best approach is creating a OncePerRequestFilter and then adding it to your web security config, inside the filter create the auth and add it to the context

Auth must be created before the request reaches the controllers

See here I have an example in a side project: https://github.com/carlos-molero/fundebt/blob/master/src/main/java/dev/carlosmolero/fundebt/filters/JWTAuthorizationFilter.java

[azure orchid]

nope i'm doing that already

i found out that this is null

String token = request.getHeader("Authorization"); 

[lyric sluice]

That’s problematic then 😂

[azure orchid]

yes

[whole hornet]

but since it's added in

.antMatchers("/api/**")
.permitAll()

that shouldn't be problem

ah got it

u have overide wrong method

    @Bean(BeanIds.AUTHENTICATION_MANAGER)
    @Nullable
    @Override
    public AuthenticationManager authenticationManager() throws Exception {
        return super.authenticationManagerBean();
    }

it should be

- public AuthenticationManager authenticationManager() ...
+ public AuthenticationManager authenticationManagerBean() ...

[azure orchid]

finally

it works

thanks

love u

[whole hornet]

🎉