Springboot Web Security Configuration not redirecting to login page - spring-boot

Question

I created a small application to learn sprint boot web security. The sample application is mostly inspired from partial instructions provided in "Spring Boot in Action" book.
The problem I am facing is that inspite of configuring access like below, when I open http://localhost:8080/readers/ishwar the application doesn't navigate to login page. It straightaway opens the page represented by http://localhost:8080/readers/ishwar. As far as I have understood the spring security if .access("") is applied then in order to check access by default spring should redirect the user to login page. But it is not.
package com.example.readingList;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
#Configuration
#EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
#Autowired
private ReaderRepository readerRepository;
#Override
protected void configure(HttpSecurity http) throws Exception
{
http.
authorizeRequests()
.antMatchers("/readers").access("hasRole('READER')")
.antMatchers("/login").permitAll()
.and()
.formLogin()
.loginPage("/login")
.permitAll()
.failureUrl("/login?error=true");
}
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception
{
auth.userDetailsService(new UserDetailsService() {
#Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
return readerRepository.getOne(username);
}
});
}
}
BUT if I change the code to below then on browsing http://localhost:8080/readers/ishwar I get redirected to login page. What is wrong in first construct? I mean why .access("") is not working
#Configuration
#EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
#Autowired
private ReaderRepository readerRepository;
#Override
protected void configure(HttpSecurity http) throws Exception
{
http.
authorizeRequests()
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/login")
.permitAll()
.failureUrl("/login?error=true");
}
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception
{
auth.userDetailsService(new UserDetailsService() {
#Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
return readerRepository.getOne(username);
}
});
}
}
Below is how ReaderRepository written
package com.example.readingList;
import org.springframework.data.jpa.repository.JpaRepository;
public interface ReaderRepository extends JpaRepository<Reader, String> {
}
Below is Reader Class. I have deliberately granted "WRITER" role as I want to see that attempt to access page should fail as READER permission is missing. But as such even if I include "READER" permission there is no change in behaviour.
package com.example.readingList;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import javax.persistence.Entity;
import javax.persistence.Id;
import java.util.Arrays;
import java.util.Collection;
#Entity
public class Reader implements UserDetails {
private static final long serialVersionUID = 1L;
#Id
private String username;
private String password;
private String fullname;
#Override
public Collection<? extends GrantedAuthority> getAuthorities() {
return Arrays.asList(new SimpleGrantedAuthority("WRITER"));
}
//#Override
public String getPassword() {
return password;
}
public void setPassword(String password)
{
this.password = password;
}
//#Override
public String getUsername() {
return username;
}
public void setUsername(String username)
{
this.username = username;
}
public String getFullname()
{
return fullname;
}
public void setFullname(String fullname)
{
this.fullname = fullname;
}
#Override
public boolean isAccountNonExpired() {
return true;
}
#Override
public boolean isAccountNonLocked() {
return true;
}
#Override
public boolean isCredentialsNonExpired() {
return true;
}
#Override
public boolean isEnabled() {
return true;
}
}
Kindly note that I haven't implemented the data source to store/fetch user and password. I was expecting to see at least the redirection to http://localhost:8080/login first but not happening if I use first construct.
Below is my pom.xml file
https://maven.apache.org/xsd/maven-4.0.0.xsd">
4.0.0
<groupId>com.example</groupId>
<artifactId>readingList</artifactId>
<version>0.0.1-SNAPSHOT</version>
<name>readingList</name>
<description>Reading List project for Spring Boot</description>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.2.4.RELEASE</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
<properties>
<java.version>1.8</java.version>
</properties>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-thymeleaf</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>com.h2database</groupId>
<artifactId>h2</artifactId>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
<exclusions>
<exclusion>
<groupId>org.junit.vintage</groupId>
<artifactId>junit-vintage-engine</artifactId>
</exclusion>
</exclusions>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
</plugin>
</plugins>
</build>
The ReadingListApplication class
#Configuration
#SpringBootApplication
public class ReadingListApplication implements WebMvcConfigurer
{
public static void main(String[] args) {
SpringApplication.run(ReadingListApplication.class, args);
}
#Override
public void addViewControllers(ViewControllerRegistry registry) {
registry.addViewController("/login").setViewName("login");
}
}
ReadingListController class
package com.example.readingList;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import java.util.List;
#Controller
public class ReadingListController {
private ReadingListRepository readingListRepository;
#Autowired
public ReadingListController(ReadingListRepository readingListRepository)
{
this.readingListRepository = readingListRepository;
}
#RequestMapping(value="/readers/{reader}", method= RequestMethod.GET)
public String readersBook(#PathVariable("reader") String reader, Model model)
{
List<Book> readingList = readingListRepository.findByReader(reader);
if (readingList.isEmpty() == false) {
model.addAttribute("books", readingList);
}
return "readingList";
}
#RequestMapping(value="/readers/{reader}", method= RequestMethod.POST)
public String addToReadingList(#PathVariable("reader") String reader, Book book)
{
book.setReader(reader);
readingListRepository.save(book);
return "redirect:/readers/{reader}";
}
}

Answer 1

It has to do with the AntPathRequestMatcher. In the first example, calling .antMatchers("/readers").access("hasRole('READER')") will not match /readers/ishwar.
Of course authorizeRequests().anyRequest().authenticated() will, which is why you were getting different behavior.
Try the following:
http.antMatchers("/readers/**")
.access("hasRole('READER')")
...