How to secure some URLS while keeping others without authentication?

Question

I have a Spring Boot based application. I want the URL /camunda/app/welcome/default/#!/login to be accessible without any authentication, while the URLs

/camunda/app/welcome/default/#!/welcome,
/camunda/app/welcome/default/#!/dashboard,
/camunda/app/tasklist/**, and
/camunda/app/admin/**

must be secured (i. e. only authenticated users should be able to access them).

To achieve this, I wrote the following configuration:

@Configuration @EnableWebSecurity public class MyConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .requestMatchers() .and() .authorizeRequests() .antMatchers("/camunda/app/welcome/default/#!/login").permitAll() .antMatchers("/camunda/app/welcome/default/#!/welcome", "/camunda/app/welcome/default/#!/dashboard", "/camunda/app/tasklist/**", "/camunda/app/admin/**", "/oauth2/authorization/**", "/oauth2/code/myredirecturl") .authenticated() .and() .oauth2Login(...) .logout() .logoutRequestMatcher(...) .logoutSuccessHandler(...); } }

However with this configuration unauthenticated users can access URLs that are supposed to be protected (/camunda/app/welcome/default/#!/welcome, /camunda/app/welcome/default/#!/dashboard, /camunda/app/tasklist/**, /camunda/app/admin/**).

What is wrong with my configuration and how can I fix it?

Alex Chernyshev · Accepted Answer · 2022-03-16 12:30:38Z

Sadly to say, but that will not work, because there is actually only one url:

/camunda/app/welcome/default/

and parts after '#' symbol are called 'anchors':

#!/welcome, #!/dashboard,

Anchors are not processed on backend, because they point to some place in html document that was loaded on client side.

https://www.w3docs.com/snippets/html/how-to-create-an-anchor-link-to-jump-to-a-specific-part-of-a-page.html

So you cant solve it by Spring only, there must be some frontend logic.

Also these two masks:

/camunda/app/tasklist/, and /camunda/app/admin/

could be covered by Spring Boot, because point to different urls, not anchors.

Eleftheria Stein-Kousathana · Accepted Answer · 2022-03-16 12:19:14Z

Make sure you use the URL encoding of #, which is %23 when calling the endpoints. Otherwise, the characters after the # will not be considered.

Making a request to /camunda/app/welcome/default/#!/welcome without properly encoding will be interpreted as a request to /camunda/app/welcome/default/. Since that endpoint doesn't require authentication then anyone will be allowed to access it.

Since all endpoints except /camunda/app/welcome/default/#!/login require authentication you condense your HttpSecurity configuration. I'll rewrite it below using the lambda style configuration to make it more readable:

http // no need to add requestMatchers since you aren't changing the default configuration .authorizeRequests(authz -> authz .antMatchers("/camunda/app/welcome/default/#!/login").permitAll() .anyRequest().authenticated() // any request that does not match the above rule ^ will require an authenticated user ) .oauth2Login(...) .logout(...)

Collectives™ on Stack Overflow

How to secure some URLS while keeping others without authentication?

2 Answers 2

Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Related