Spring Security | Java Community | Help. Code. Learn. | Page 1

keen drift Jun 19, 2024, 5:40 PM

#

I dont know why but i am not getting default login page after enabling the @WebSecurity annoation ..


import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;


@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

}


import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;

public class SecurityIntializer extends AbstractSecurityWebApplicationInitializer {

}
``` This is the classes and in the photo that is my project structure . Can anyone Help

ivory fiberBOT Jun 19, 2024, 5:40 PM

#

⌛ This post has been reserved for your question.

Hey @keen drift! Please use /close or the Close Post button above when your problem is solved. Please remember to follow the help guidelines. This post will be automatically closed after 300 minutes of inactivity.

TIP: Narrow down your issue to simple and precise questions to maximize the chance that others will reply in here.

carmine sundial Jun 19, 2024, 5:41 PM

#

What actually happens?

keen drift Jun 19, 2024, 5:49 PM

#

basically i have started spring security module and trying to start the basic security to my endpoint of the controllers via 2 classes called SecurityConfigurationand SecurityIntializer but when i start the project then i didnot get any default login page for security purpose . I think the security page is automatically added to the project using the @Enable Web Security annoatation right ?

dark ether Jun 19, 2024, 5:50 PM

#

hi. I will show my code.

#

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Autowired
    AuthDetailsServiceImpl userDetailsService;

    @Autowired
    private AuthEntryPointJwt  unauthorizedHandler;
    @Bean
    public AuthTokenFilter authenticationJwtTokenFilter() {
        return new AuthTokenFilter();
    }
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();

        authProvider.setUserDetailsService(userDetailsService);
        authProvider.setPasswordEncoder(passwordEncoder());

        return authProvider;
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.csrf(csrf -> csrf.disable())
                .cors(cors -> cors.disable())
                .exceptionHandling(exception -> exception.authenticationEntryPoint(unauthorizedHandler))
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .authorizeHttpRequests(auth ->
                        auth.requestMatchers("/auth/**").permitAll()
                                .requestMatchers("/test/**").permitAll()
                                .requestMatchers("/error").permitAll()
                                .anyRequest().authenticated()
                );

        http.authenticationProvider(authenticationProvider());

        http.addFilterBefore(authenticationJwtTokenFilter(), UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }
}

#

please try it.

keen drift Jun 19, 2024, 5:58 PM

#

dark ether hi. I will show my code.

Right now I am following a tutorial and that guy just got a login page for authentication and authorisation after just adding the two classes for config and initialisation as I mentioned above . So is that thing removed now bcz that video is 3 yrs old !

carmine sundial Jun 19, 2024, 5:58 PM

#

Can you show your pom.xml? I think the default login page is there only if you use Spring Boot

keen drift Jun 19, 2024, 5:59 PM

#

📎 message.txt

#

i am not using spring boot now either i am using spring mvc instead

#

What should be the right ?

dark ether Jun 19, 2024, 6:01 PM

#

what version of maven is your project?

keen drift Jun 19, 2024, 6:02 PM

#

I have already given the pom.xml

#

@carmine sundial

carmine sundial Jun 19, 2024, 6:06 PM

#

dark ether ``` @Configuration @EnableWebSecurity public class SecurityConfig { @Autowi...

That's Spring 6. They are using Spring 5.

carmine sundial Jun 19, 2024, 6:07 PM

#

keen drift I dont know why but i am not getting default login page after enabling the @WebS...

Can you try overriding the configure method in your WebSecurityConfigurerAdapter and add .formLogin() there?

keen drift Jun 19, 2024, 6:08 PM

#

carmine sundial Can you try overriding the configure method in your WebSecurityConfigurerAdapter...

Which one ?

carmine sundial Jun 19, 2024, 6:08 PM

#

Which are available?

#

Btw Spring 5 will be out of Open Source support soon

keen drift Jun 19, 2024, 6:09 PM

#

Hmm so I have to use spring 6 for my upcoming projects ?

carmine sundial Jun 19, 2024, 6:09 PM

#

I would strongly recommend doing that

keen drift Jun 19, 2024, 6:12 PM

#


import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;


@EnableWebSecurity(debug = true)
public class Config extends WebSecurityConfigurerAdapter {

     @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                .authorizeRequests()
                    .antMatchers("/public/**").permitAll()  // Permit access to public resources
                    .anyRequest().authenticated()  // All other requests must be authenticated
                    .and()
                .formLogin()
                    .loginPage("/login")  // Custom login page URL
                    .defaultSuccessUrl("/dashboard")  // Redirect to this URL after successful login
                    .permitAll()  // Allow everyone to access the login page
                    .and()
                .logout()
                    .logoutUrl("/logout")  // URL to trigger logout
                    .logoutSuccessUrl("/login?logout")  // Redirect to this URL after logout
                    .permitAll();  // Allow everyone to access the logout URL

            // Disable Cross-Site Request Forgery (CSRF) protection for simplicity
            http.csrf().disable();
        }

        // Bean for PasswordEncoder (BCryptPasswordEncoder)
        @Bean
        public PasswordEncoder passwordEncoder() {
            return new BCryptPasswordEncoder();
        }
    
}
``` i did it but not get anything its same

dark ether Jun 19, 2024, 6:12 PM

#

SecurityConfig.java

import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .anyRequest().authenticated()  // Require authentication for all requests
                .and()
            .formLogin()  // Enable form-based authentication
                .loginPage("/login")  // Specify the custom login page URL
                .permitAll()  // Allow everyone to see the login page
                .and()
            .logout()  // Enable logout functionality
                .permitAll();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

#

If you do not create a custom login page and do not specify loginPage("/login"), Spring Security will provide its default login page at the /login endpoint. However, the configuration above ensures that your application uses form-based authentication and handles the login functionality appropriately.

#

If you follow these steps and still do not see the default login page, make sure there are no other configurations or security settings that might be overriding these settings. Double-check your application logs for any errors or warnings related to security configuration.

keen drift Jun 19, 2024, 6:19 PM

#



import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.validation.BindingResult;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;




@Controller
public class login {
    
    @ResponseBody
    @GetMapping("/hii")
    public String name() {
        return"Hii";
    }
 
}
``` This is my controller for checking is this Ok ?

#

@dark ether

dark ether Jun 19, 2024, 6:23 PM

#

this is accurate controller.

#

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;

@Controller
public class LoginController {

    @GetMapping("/login")
    public String login() {
        return "login";
    }
}

dark ether Jun 19, 2024, 6:23 PM

#

keen drift ```package com.controllers; import org.springframework.stereotype.Controller; ...

I will check it.

keen drift Jun 19, 2024, 6:23 PM

#

Alright waiting for the response

dark ether Jun 19, 2024, 6:26 PM

#

do you know @ResponseBody annotation?

#

Ensures that the response from the name() method is written directly to the HTTP response body.
I think your controller is right.

carmine sundial Jun 19, 2024, 6:28 PM

#

dark ether do you know @ResponseBody annotation?

it just means what you return is converted to text and sent back to the user

#

If you don't have @ResponseBody, it typically tries to render the response

keen drift Jun 19, 2024, 6:29 PM

#

I have already added the responseBody annotation

keen drift Jun 19, 2024, 6:30 PM

#

dark ether Ensures that the response from the name() method is written directly to the HTTP...

Then whats the issue why the default login page is not showing after hitting the /hii endpoint

carmine sundial Jun 19, 2024, 6:31 PM

#

@ResponseBody won't show any login page

keen drift Jun 19, 2024, 6:33 PM

#



import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.validation.BindingResult;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;




@Controller
public class login {
    
    
    @GetMapping("/hii")
    public String name() {
        return"Hi";
    }
 
}
``` ok now i have removed it and also added a hi.jsp to the retrun but still i can access the jps page or u can say /hii endpoint

carmine sundial Jun 19, 2024, 6:34 PM

#

Is your security configuration attempting to prevent that in any way?

keen drift Jun 19, 2024, 6:34 PM

#

Wdym ?

carmine sundial Jun 19, 2024, 6:35 PM

#

Why should it not be accessible?

keen drift Jun 19, 2024, 6:35 PM

#


import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;


@EnableWebSecurity(debug = true)
public class Config extends WebSecurityConfigurerAdapter {

     @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                .authorizeRequests()
                    .anyRequest().authenticated()  // Require authentication for all requests
                    .and()
                .formLogin()  // Enable form-based authentication
                    .loginPage("/login")  // Specify the custom login page URL
                    .permitAll()  // Allow everyone to see the login page
                    .and()
                .logout()  // Enable logout functionality
                    .permitAll();
        }

        @Bean
        public PasswordEncoder passwordEncoder() {
            return new BCryptPasswordEncoder();
        }
    }

#

This is what I did

carmine sundial Jun 19, 2024, 6:37 PM

#

You called your package config?

#

Can you show your beans.xml?

keen drift Jun 19, 2024, 6:38 PM

#

carmine sundial You called your package `config`?

Yehh

keen drift Jun 19, 2024, 6:39 PM

#

carmine sundial Can you show your beans.xml?

Beans.xml ?

carmine sundial Jun 19, 2024, 6:39 PM

#

Do you have such a file?

#

Spring doesn't scan all packages, it only scans package under some root package

keen drift Jun 19, 2024, 6:39 PM

#

No

#

I have web.xml

carmine sundial Jun 19, 2024, 6:40 PM

#

carmine sundial Spring doesn't scan all packages, it only scans package under some root package

and if something isn't in that root package, Spring won't find it

#

So Spring doesn't know anything about your Config class

keen drift Jun 19, 2024, 6:41 PM

#

I think no !

#

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:context="http://www.springframework.org/schema/context"
    xmlns:p="http://www.springframework.org/schema/p"
    xmlns:tx="http://www.springframework.org/schema/tx"
    xmlns:util="http://www.springframework.org/schema/util"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
    http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/context 
    
    http://www.springframework.org/schema/context/spring-context.xsd
    http://www.springframework.org/schema/util 
    http://www.springframework.org/schema/util/spring-util.xsd
    
    http://www.springframework.org/schema/tx
    http://www.springframework.org/schema/tx/spring-tx.xsd
    ">
    
      <context:component-scan base-package="com.controllers"></context:component-scan>
      
      <bean id = "viewresolver" class="org.springframework.web.servlet.view.InternalResourceViewResolver"> 
      
      <property name="prefix" value="/WEB-INF/lib/view/"></property>
      <property name="suffix" value=".jsp"></property>
      
      </bean>

</beans>```

carmine sundial Jun 19, 2024, 6:41 PM

#

that was a typo

#

I wanted to write So instead of Do

#

this wasn't a question

carmine sundial Jun 19, 2024, 6:42 PM

#

keen drift ```<?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframewo...

you see the base-package="com.controllers"?

#

That means Spring will only find stuff in com.controllers

keen drift Jun 19, 2024, 6:44 PM

#

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:context="http://www.springframework.org/schema/context"
    xmlns:p="http://www.springframework.org/schema/p"
    xmlns:tx="http://www.springframework.org/schema/tx"
    xmlns:util="http://www.springframework.org/schema/util"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
    http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/context 
    
    http://www.springframework.org/schema/context/spring-context.xsd
    http://www.springframework.org/schema/util 
    http://www.springframework.org/schema/util/spring-util.xsd
    
    http://www.springframework.org/schema/tx
    http://www.springframework.org/schema/tx/spring-tx.xsd
    ">
    
      <context:component-scan base-package="com.controllers , config"></context:component-scan>
      
      <bean id = "viewresolver" class="org.springframework.web.servlet.view.InternalResourceViewResolver"> 
      
      <property name="prefix" value="/WEB-INF/lib/view/"></property>
      <property name="suffix" value=".jsp"></property>
      
      </bean>

</beans>``` is this ok

carmine sundial Jun 19, 2024, 6:45 PM

#

Why don't you just create one common package and put all your application classes in subpackages?

keen drift Jun 19, 2024, 6:46 PM

#

carmine sundial Why don't you just create one common package and put all your application classe...

but the issue is still same

carmine sundial Jun 19, 2024, 6:47 PM

#

no

#

if your base package is com.yourapplication and you have classes in °com.yourapplication.controllersandcom.yourapplication.config`, these should be detected

keen drift Jun 19, 2024, 6:51 PM

#

Package are not scanning

carmine sundial Jun 19, 2024, 6:52 PM

#

you need to set it to com.application

#

not com.application.*

keen drift Jun 19, 2024, 6:53 PM

#

Still 404 error

#

00:23:10.464 [http-nio-8080-exec-1] WARN org.springframework.web.servlet.PageNotFound - No mapping for GET /LoginPage/
00:23:10.467 [http-nio-8080-exec-1] DEBUG org.springframework.web.servlet.DispatcherServlet - Completed 404 NOT_FOUND```

carmine sundial Jun 19, 2024, 6:53 PM

#

Do you have a handler for that?

keen drift Jun 19, 2024, 6:54 PM

#

Yess /hii

carmine sundial Jun 19, 2024, 6:54 PM

#

And you are accessing /hii in your browser?

keen drift Jun 19, 2024, 6:54 PM

#

Yess

#

http://localhost:8080/LoginPage/hii

#

like this

carmine sundial Jun 19, 2024, 6:56 PM

#

How are you running the application?

#

Do you have a servers view in Eclipse?

keen drift Jun 19, 2024, 6:57 PM

#

#

like this ?

#

when i write this in scan com.applicationcom.controllers then it works but not with com.applicationcom

carmine sundial Jun 19, 2024, 7:39 PM

#

com.application

#

not com.applicationcom

#

but ig if it works, it's fine

keen drift Jun 19, 2024, 7:40 PM

#

i did the same project on spring boot and it runs perfectly @carmine sundial

#

some one said to me that WebsecurityConfigurerAdapter is deprecated…
is deprecated is that real ?

carmine sundial Jun 19, 2024, 7:52 PM

#

keen drift some one said to me that WebsecurityConfigurerAdapter is deprecated… is depreca...

It is in Spring 6

keen drift Jun 19, 2024, 8:05 PM

#

carmine sundial It is in Spring 6

So the concepts are same or just changed ?

ivory fiberBOT Jun 20, 2024, 1:10 AM

#

💤 Post marked as dormant

This post has been inactive for over 300 minutes, thus, it has been archived.
If your question was not answered yet, feel free to re-open this post or create a new one.
In case your post is not getting any attention, you can try to use /help ping.
Warning: abusing this will result in moderative actions taken against you.

copper bridge Sep 25, 2024, 3:24 PM

#

What did I said wrong?

carmine sundial Sep 25, 2024, 3:30 PM

#

?

copper bridge Sep 25, 2024, 3:30 PM

#

He blocked me or removed from friends. I want to get him back. tried to search from history.

carmine sundial Sep 25, 2024, 3:31 PM

#

copper bridge He blocked me or removed from friends. I want to get him back. tried to search f...

and you think pinging them would result in a notification?
Anyways, please don't try to contact people that blocked you via this Discord.

copper bridge Sep 25, 2024, 3:33 PM

#

ok. Lock this question.

ivory fiberBOT Sep 28, 2024, 5:00 PM

#

💤 Post marked as dormant

This post has been inactive for over 300 minutes, thus, it has been archived.
If your question was not answered yet, feel free to re-open this post or create a new one.
In case your post is not getting any attention, you can try to use /help ping.
Warning: abusing this will result in moderative actions taken against you.

#Spring Security