I have a Spring Boot application running with Spring Security in a Ubuntu server. The application is listening on port 9090 and I have added a port forward from port 80 to port 9090.
However I'm having trouble serving static content via port 80 (getting 403 responses).
If I make the same request via port 9090 the request works ok.
Do I have to add something to the Spring Security config class?
EDIT: The behaviour seems to be somewhat erratic. Just restarted the webserver and it looks that is able to serve some static contents. Html, css and js are working fine. Favicon and some image files are still not working (403 response).
Related
I have a spring boot web service running on localhost:8000 with an embedded Apache Tomcat.
Frontend is developed using Angular and is running on nginx and port 80. Connection between front- and back-end is established with a REST API endpoint, i.e. /v1/getdata/...
We have a static IP and outside access is OK with this configuration. But after setting a DNS record, i.e. https://x.y.com for the static IP, the spring web server does not return data and ERR_TUNNEL_CONNECTION_FAILED error is occurred in Angular, although the front-end is loaded successfully on port 80.
The only server-side configurations in Spring app is server.port=8000 and CORS configs.
I have set [STATIC-IP]:8000 and https://x.y.com:8000 for the api address in Angular but neither worked. However accessing with static IP is still working.
I think there is a problem with SSL configuration.
Any Ideas?
I am adding the secure port with the non-secure port already opened. I wants to separate the traffic between two and forward to different Spring boot 2 Controllers. Wonder how I can achieve that?
In most solutions I have seen so far, https / SSL is terminated infront of Tomcat or Spring Boot application, so that Tomcat / Spring Controller receives only http requests on port 8080 (for example).
Termination of SSL in front of Tomcat / Spring Boot could be done with a Reverse Proxy or Web Server, like Apache2 or nginx.
Then the communication flow looks like this:
User ==HTTP-80==> Apache2 ==HTTP-8080==> Tomcat/Spring Boot
User ==HTTPS-443==> Apache2 ==HTTP-8080==> Tomcat/Spring Boot
("HTTP-80" means HTTP protocol on port 80. "== ==>" is arrow showing communication flow.)
I already have a tomcat server running in a VM with port as 443 and redirect port as 8443. Can I configure the redirect port for spring boot application also as 8443 and run in same VM? Would I face error like port already in use? If yes, are there any specific port to be used for this purpose? I would not like to try since this is a production environment VM.
By default the https port used is 9393 in springboot.So , in your application if you need it to be 8443 , you need to configure it in the application.properties or application.yml like
application.yml
server:
port: 8443
or
application.properties
server.port=8443
Yes, you will have issues if some other application is using the same https port on the same VM, you will have to find a port that is not used by any other application and assign it for your springboot application. Check in your vm if any other application is already mapped to this port, if not you can use this port without any issues.
Please note that :
If HTTPS is enabled, it will completely replace HTTP as the protocol
over which the REST endpoints and the Data Flow Dashboard interact.
Plain HTTP requests will fail - therefore, make sure that you
configure your Shell accordingly.
Spring doc.
I have a spring boot application in which tomcat is listening on port 8000 over HTTPS. However, when port 8000 is hit with plain http request, the server responds with http 400.
Bad Request
This combination of host and port requires TLS.
Is there a way to prevent this? I don't want server to send any response when http://localhost:8000 is requested. Spring boot and tomcat versions are as below:
sprint-boot v2.0.0.RELEASE
tomcat v8.5.28
Update: application.properties is as below
server.port=8000
server.ssl.enabled=true
server.ssl.key-alias=alias
server.ssl.key-store=classpath:key.jks
server.ssl.key-store-type=JKS
server.ssl.key-store-password=<password>
server.ssl.key-password=<password>
You enabled SSL Just change server.ssl.enabled=true toserver.ssl.enabled=false
I'm trying to get my spring security working on a server using Amazon Elastic Load Balancer (ELB). The ELB is configured on port 80 to forward to my app on port 8080 and on port 443 to also forward to 8080.
<security:intercept-url pattern="/login.xhtml" access="IS_AUTHENTICATED_ANONYMOUSLY" requires-channel="https" />
<security:port-mappings>
<security:port-mapping http="80" https="443" />
</security:port-mappings>
Whenever I access this page I get into a login loop. Any idea how to solve this? Not sure if Spring Security is having issues with the fact ELB is forward traffic from https port 443 to my app on port 8080.
It turns out that Spring Security uses ServletRequest.getServerPort() to determine whether it is using a secure port. My tomcat was configured using 8080 and 8443 so when the ELB forward the request from 443 to my internal tomcat on 8443 the webapp did not accept this as a secure port:
20 Jun 18:16:49,184 ["http-bio-8443"-exec-5] DEBUG org.springframework.security. web.access.channel.RetryWithHttpsEntryPoint - Redirecting to: /login.xhtml
I also tried using the proxyport but couldnt get this to work.
Also if you configure the spring security ports to use 8443 instead then it doesnt do the redirect correctly (it will redirect the app to 8443 which doesnt exist externally).
Long story short...the following settings worked:
ELB forward 80->80 and 443->443.
Setup tomcat to use 80 and 443.
Setup port mappings to use 80 and 443 on Spring Security
A redirect loop almost always happens because you have a secured URL which should not be secured. All URLs are secured by default in spring security.
Also if JavaScript, CSS or image resources are loaded with separate requests by the login page their URLs are also secured and this might be causing the loop.
Enable the debug log and you should see why you get redirected.
This will help you on debug logging (search the page for debug).