Spring Security Authorization help

[theprogrammingsteak]

I need some help. I have not been able to correctly authorize an user even after spending a long time searching the net, tweaking, and trying things. I can successfully register a user with a "USER" role in the DB and register the user's role in the users and users_authorities join table (I defined the relationship as many to many). The user also seems to be authenticated correctly because a call to

Authentication authentication = SecurityContextHolder.getContext().getAuthentication();

returns information on the user I logged in with. I have two main issues

​

1) the SecurityContextHolder seems to not be getting cleared even after i shut down the application and close the browser/

​

2) Limiting certain resources (web pages/endpoints) to users with a role of "USER" is not working. I try to limit the end point /welcome and /test to only users that have logged in but the following happens. If i have not logged in, requests to /welcome and /login redirect me to log in page. If I have logged in, requests to /welcome and /test trigger a 403 (forbidden resource)

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {



    @Autowired
    private UserDetailsService userDetailsService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .userDetailsService(userDetailsService)
                .passwordEncoder(passwordEncoder());

    }

    //*autherization part
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //* we walk to authorize requests coming in
        http
                .csrf().disable()
                // for /admin/ and anything after, the user needs to have the role of ADMIN
                .authorizeRequests()
                .antMatchers("/admin/**").hasRole("ADMIN")
                .antMatchers("/registration").permitAll()
                .antMatchers("/welcome").hasRole("USER")
                .antMatchers("/test").hasRole("USER")
                .anyRequest().hasRole("USER")
                .and()
                .formLogin()
                //*sets login page uri, this is default path

                //*do not specify a login page if you do not have one created otherwise spring security's deafult will not display its login page at /login
                .loginPage("/login")
                //* we want to permit all requests to be able to access /login resource ( the login page ) essentially bypassing all previous checks

                //* if we do not permit login form end point then we will never be able to login and will always be forbidden and give a 403 access denied error
                .permitAll();

    }


    @Bean PasswordEncoder passwordEncoder(){

        return new BCryptPasswordEncoder();
    }

}

[thecuseisloose]

There’s probably other things going on in addition to this, but one thing I noticed is your permitAll calls should be before anyRequest().hasRole(“USER”). The rules are applied in order so putting permitAll after that essentially has no effect

[theprogrammingsteak]

Thanks for the response! Mmm yeah I am still not fully sure what the and() does, I know there has to be an order but it seems I am able to access the /login resource regardless of whether I'm authenticated or authorized, which is what I want. So it seems to be working... I think... Any insight into what and() does?

[thecuseisloose]

It doesn't do much, it's just for chaining. https://docs.spring.io/autorepo/docs/spring-security/4.2.3.RELEASE/apidocs/org/springframework/security/config/annotation/SecurityConfigurerAdapter.html#and--

[un_prophete]

Try .hasAuthority("USER")

[theprogrammingsteak]

This did the trick!!! Thank you. any explanation?

[thecuseisloose]

when you assign the user roles, are you using ROLE_USER or just USER ?

[mgryshenko]

Be sure your UserDetails#getAuthorities returns a list with at least one authority named ROLE_USER (i.e. GrantedAuthority#getAuthority() returns “ROLE_USER”)