Spring Boot Security + GWT, static resources access 403 error - spring

I am fighting the css/js access problem in my gwt+spring security simple application. So, i have secutiy controller with the next method:
#GetMapping(value = "/notes")
public ModelAndView index(ModelAndView modelAndView) {
modelAndView.setViewName(VIEW_NOTES);
return modelAndView;
}
By the way, I integrated these technologies according to this article. So, thanks to this controller method (I use RestController) we've got resolved view (simple as ****):
<!DOCTYPE html>
<html lang="en">
<head>
<title>Notes</title>
<link rel="stylesheet" type="text/css" media="all"
href="../static/css/notes-main.css"></link>
</head>
<body>
<!-- This script tag is what actually loads the GWT module. The -->
<!-- 'nocache.js' file (also called a "selection script") is -->
<!-- produced by the GWT compiler in the module output directory -->
<!-- or generated automatically in development mode. -->
<script language="javascript" src="notesgwtapp/notesgwtapp.nocache.js">
</script>
<!-- Include a history iframe to enable full GWT history support -->
<!-- (the id must be exactly as shown) -->
<iframe src="javascript:''" id="__gwt_historyFrame"
style="width:0;height:0;border:0"></iframe>
<div id="notes"></div>
</body>
</html>
Now is the most interesting thing that I have these two errors:
GET http://localhost:8080/static/css/notes-main.css 403
GET http://localhost:8080/notesgwtapp/notesgwtapp.nocache.js 403
I dont have problems with resolving resources for other views, btw.
Please help, how can I handle it? If i miss some important part of code, I will add it. Just ask. Thank you in advance.

By default Sprint Boot permits all access to /js/**, /css/**, /images/**. But you try to access /static/** and /notesgwtapp/** which will result in the 403 error (see here).
There are two solutions:
Make sure that the notesgwtapp.nocache.js and the notes-main.css file end up in one of the above folders or
Override the SecurityConfig of your Spring Boot app and add the /static/** and /notesgwtapp/** folder to the permitted locations.

Related

How to fix this springboot ErrorPageFilter error?

It's a simple web application use external tomcat-9.0.56 and spring 5.3, springboot 2.5.5 and up, which works on windows 10 but not on ubuntu 18. It always display 404 because of the ErrorFilterPage.
The tomcat used Context to point to the folder where the webapp was located at, also virtual host in apache 000-default.conf
I've tried set setRegisterErrorPageFilter(false); or in the application.properties as well as inject #Bean FilterRegistrationBean disableSpringBootErrorFilter with/without return new ErrorPageFilter(); in #Bean public ErrorPageFilter errorPageFilter(), no success.
I feel despair at such a framework that can not deploy to Ubuntu with delays and disappointment that cause me a lot.
It's just a simple hello: http://localhost:8080/home:
https://drive.google.com/file/d/1BiJ4-E0nPjuh1YxREpOcwN4AlzdSe3Pu/view?usp=sharing
How to fix it?!
There's a typo in your application.properties file where you have configured spring.mvc.view.prefix. The value has a trailing space. It is /WEB-INF/views/ and should be /WEB-INF/views/. With this change in place, the /hello endpoint works:
$ curl localhost:8080/hello
<!DOCTYPE html>
<html>
<head>
<meta charset="ISO-8859-1">
<title>SAMPLE</title>
</head>
<body>
HELLO SPRING!
</body>
</html>%
Spring Boot intentionally does not trim whitespace from property values as there's no way for it to know whether or not the whitespace is intentional.

(WAR) Spring Boot Admin custom view not found

Once deployed as a WAR into Tomcat, my customized SBA dashboard fails at showing a custom view that was first doing fine into a JAR (but it also fails now, btw)
This is where is located the extension's directory into the WAR:
/WEB-INF/classes/META-INF/spring-boot-admin-server-ui/extensions/customz/...
REM: I've also customized the login page and my picture is located at /WEB-INF/classes/META-INF/spring-boot-admin-server-ui/assets/img/ so I guess that the classpath isn't the issue.
Still, I've got an error into the web browser's console, though:
GET http://xx.xx.xx.xx:8080/extensions/customz/css/custom.fb3a4f29.css net::ERR_ABORTED 404
REM: according to my context path, the correct path should probably be that one:
http://xx.xx.xx.xx:8080/myapp/dashboard/extensions/customz/css/custom.fb3a4f29.css
server.servlet.context-path=/myapp
spring.boot.admin.context-path=/dashboard
...
<packaging>war</packaging>
<build>
<finalName>myapp</finalName>
...
</build>
But I couldn't figure out how to change the base path for my views in this case. I should just have to prefix somehow the system with my "customz/dashboard" context path (?)
Does anybody, please, know how to get out of this trap?
NB: Spring Boot 2.2.8, Spring Cloud Hoxton.SR5, SBA 2.2.3, Tomcat 9.0.36
AdminServerUiAutoConfiguration declares resource handlers for the extensions (mapping context-path/extensions/** to the above classpath, as figured out when I tried to visualize custom JS and CSS earlier.
Remember that spring.boot.admin.ui.extension-resource-locations default is classpath:/META-INF/spring-boot-admin-server-ui/extensions/ which seems fine in my case. That confirms that custom views are correctly exposed.
So that leads us to spring-boot-admin-server-ui/src/main/frontend/index.html where all paths appear to be ... absolute!
<th:block th:each="cssExtension : ${cssExtensions}">
<link rel="preload" th:href="'/extensions/' + ${cssExtension.resourcePath}" as="style">
</th:block>
<th:block th:each="jsExtension : ${jsExtensions}">
<link rel="preload" th:href="'/extensions/' + ${jsExtension.resourcePath}" as="script">
</th:block>
<th:block th:each="cssExtension : ${cssExtensions}">
<link th:href="'/extensions/' + ${cssExtension.resourcePath}" rel="stylesheet">
</th:block>
<link rel="shortcut icon" th:href="${uiSettings.favicon}" type="image/png">
<title th:text="${uiSettings.title}">Spring Boot Admin</title>
...
<script lang="javascript" src="sba-settings.js"></script>
<th:block th:each="jsExtension : ${jsExtensions}">
<script lang="javascript" th:src="'/extensions/' + ${jsExtension.resourcePath}"></script>
</th:block>
I guess these are two points where both servlet and admin ui context paths should be added in order for extensions to be held. May be tehe quickest way would be to URls relative in index.html
So I did exactly that... git cloning SBA on tag 2.2.3, doing the changes and Maven installing it, changing my server's parent to SNAPSHOT, then rebuilding the WAR into Tomcat. Et voilĂ .

Spring Boot not loading static resources it depends on RequestMapping depth

I have problem to load the file under static folder on spring boot application.
The problem is RequestMapping depth more than 2 like #RequestMapping("spring/xyz")
The #RequestMapping("spring") single depth works well but 2 depth is prefixed 'spring' it is connect localhost:8080/spring/'static folder'
I found half solution here
my folder structure is:
static/css/some.css
static/templates/velocity.vm
case 1: works well
java:
#RequestMapping("spring")
html:
<link rel="stylesheet" href="css/some.css">
case2: works well
java:
#RequestMapping("spring/xyz")
html:
<link rel="stylesheet" href="../css/some.css">
case3: not working
java:
#RequestMapping("spring/xyz/123")
html:
<link rel="stylesheet" href="../css/some.css">
it is called 'http//localhost/spring/xyz/css/some.css'
case3: works well
java:
#RequestMapping("spring/xyz/123")
html:
<link rel="stylesheet" href="../../css/some.css">
case4: works well
java:
#RequestMapping("123")
html:
<link rel="stylesheet" href="../../css/some.css">
It works!! even if I use ../../ relative path.
I don't know why this works.
Actually I didn't understand Spring Boot API well that I consider use ViewResoler something load other static resources.
I want to know this load path machanism and how to the RequestMapping url path link to call the 'http//localhost/spring/xyz/css/some.css'
I appriciate any answer thanks~!!
I refer to the same issue on spring.io here from 'metalhead' and 'Brian Clozel'
if you are using thymeleaf you can also specify the path as :
<link rel="stylesheet" th:href="#{/css/main.css}"
href="../static/css/main.css" />
it worked properly for me for any depth.

How to implement layout template with spring boot and mustache

I have a Sprint Boot Web Maven project created from Spring Initlializer with Mustache templating engine.
So far, its working and I can do the basic things but I want to set a layout (template) that will include the main body of html e.g. <html>...</html> whilst my view template will only include the page content e.g. <h1>Hello World</h1>
I can get partials to work so I could do {{>header}}<h1>Hello World</h1>{{>footer}}
What I want to be able to do is:
index.html
{{>header}}{{>content}}{{>footer}}
home.html
<h1>Hello World</h1>
I can't find any tutorial or documentation how do this.
If it helps, I found some reference documentation here:
https://spring.io/blog/2016/11/21/the-joy-of-mustache-server-side-templates-for-the-jvm
See the section on Natural Templates.
{{!
<!doctype html>
<html lang="en">
<body>
}}
{{>header}}
<h1>Demo</h1>
<div>Hello World</div>
{{>footer}}
{{!
</body>
</html>
}}

How to make spring mvc app run under a sub folder

I was only testing my spring-mvc as a root app on top of tomcat 7.0.50, now however I need to run at under a subfolder of the domain, like www.blabla.com/myapp
Unfortunately it does not work: all the resource files are missing and the application tries to redirect itself to root all the time.
How do i configure a spring mvc application to run under a subfolder?
I think it depends on your configuration of your HTTP Server (Apache, Nginx) and it has nothing to do with Spring.
The basic problem was that all references (including form actions) in jsp pages are absolute (a least with my current configuration) and I had to c:url them.
static resources:
<link href="<c:url value="/resources/css/bootstrap.css"/>" rel="stylesheet" type="text/css"/>
form actions:
<c:url var="proceedActionUri" value="/user/mainscreen"/>
<form:form method="post" action="${proceedActionUri}" commandName="user" role="form">

Resources