Spring web and security. Add /api prefix to login route - spring

Question

I am using spring security. I need to add the /api prefix to the login route. I am extending the UsernamePasswordAuthenticationFilter class
JWTAuthenticationFiler.class
public class JWTAuthenticationFilter extends
UsernamePasswordAuthenticationFilter{
private AuthenticationManager authenticationManager;
public JWTAuthenticationFilter(AuthenticationManager authenticationManager) {
this.authenticationManager = authenticationManager;
}
#Override
public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
throws AuthenticationException {
try {
User creds = new ObjectMapper()
.readValue(request.getInputStream(), User.class);
return authenticationManager.authenticate(
new UsernamePasswordAuthenticationToken(
creds.getUsername(),
creds.getPassword(),
new ArrayList<>())
);
} catch (IOException e) {
throw new RuntimeException(e);
}
}
#Override
protected void successfulAuthentication(HttpServletRequest request,
HttpServletResponse response,
FilterChain chain,
Authentication authResult) throws IOException, ServletException {
String token = Jwts.builder()
.setSubject(((org.springframework.security.core.userdetails.User) authResult.getPrincipal()).getUsername())
.setExpiration(new Date(System.currentTimeMillis() + SecurityConstants.EXPIRATION_TIME))
.signWith(SignatureAlgorithm.HS512, SecurityConstants.SECRET.getBytes())
.compact();
response.addHeader(SecurityConstants.HEADER_STRING, token);
}
}
The base class contains in constructor instantiation of the login route:
public class UsernamePasswordAuthenticationFilter extends
AbstractAuthenticationProcessingFilter {
// ~ Static fields/initializers
// =====================================================================================
public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";
private String usernameParameter = SPRING_SECURITY_FORM_USERNAME_KEY;
private String passwordParameter = SPRING_SECURITY_FORM_PASSWORD_KEY;
private boolean postOnly = true;
// ~ Constructors
// ===================================================================================================
public UsernamePasswordAuthenticationFilter() {
super(new AntPathRequestMatcher("/login", "POST"));
}
...
I have to override somehow the "/login" to "/api/login". How to do that?
Thank you!

Answer 1

To change the default value for filterProcessesUrl in your custom authentication filter extending UsernamePasswordAuthenticationFilter you have to use setRequiresAuthenticationRequestMatcher, see AbstractAuthenticationProcessingFilter:
This filter will intercept a request and attempt to perform authentication from that request if the request matches the setRequiresAuthenticationRequestMatcher(RequestMatcher).
with a RequestMatcher that matches your custom URL.
You can call the setter in your constructor, in your factory method or in XML configuration.

Answer 2

I suppose you use the WebSecurityConfigurerAdapter. Therefore you have to use the formLogin in order to set the login endpoint.
public class SecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/apilogin*").permitAll()
.anyRequest().authenticated()
.and().formLogin().loginPage("/apilogin")
.and().httpBasic();
}
}

Answer 3

I believe you need to call setRequiresAuthenticationRequestMatcher on the filter when defining the bean in your configuration class.
code.setRequiresAuthenticationRequestMatcher(
new AntPathRequestMatcher("/api/login","POST"));
#Bean
public UsernamePasswordAuthenticationFilter authenticationFilter() {
UsernamePasswordAuthenticationFilter authFilter = new UsernamePasswordAuthenticationFilter();
authFilter.setRequiresAuthenticationRequestMatcher(new AntPathRequestMatcher("/login","POST"));
return authFilter;
}