Login-bar with Spring Secuirty - spring

I'm developing a Spring-based web application by using Spring Boot and Spring Security.
I've a specific and detailed login page {mywebapp}/login, but I'd like to have also a login-bar in every page with the aim to offer a fast login facility.
How can I setup my project to achieve this goal (by using Java Config, hence annotations and methods, avoiding xml files)?

If I got your question well, you have to use whatever templating system you are using to generate the html pages and add a section to your layout that is shared across all pages consisting of a form like this (I'm assuming you are using spring-security defaults):
<form action="${request.contextPath}/login" method="POST">
<input type="text" name="username" value="" placeholder="Username" />
<input type="password" name="password" placeholder="Password" />
<input name="submit" type="submit" value="Login" />
</form>
I'm also assuming you have your login detailed page fully working using spring-security with user/password default login support.
Hope it helps.

Related

Migration from Struts to Spring

I am working on a project in which we are migrating from Struts 1.3 to Spring MVC 3.0.
There is a problem with JSP as discussed below:
tag of Struts is used to retrieve collection from Java class.
My question is that...
Is there any tag that can replace <html:optionsCollection> tag of struts to Spring MVC?
<form:select onchange="javascript:changeSelectedType();" property="countryType" styleClass="form-control">
<html:optionsCollection property="stateType"/>
</form:select></code>
You can simply use this :
<form:select path="country">
<form:option value="NONE" label="--- Select ---"/>
<form:options items="${countryList}" />
</form:select>
Good luck

AjaxRenderKitFactory is blocking AJAX in my web project

I am facing an issue related to Ajax in JSF 2.0
We have 2 web projects (WARs) in the same EAR. the first project is having the following in the faces-config.xml
<factory>
<faces-context-factory>
com.ibm.faces.context.AjaxFacesContextFactory
</faces-context-factory>
<render-kit-factory>
com.ibm.faces.renderkit.AjaxRenderKitFactory
</render-kit-factory>
</factory>
For some reason, the com.ibm.faces.renderkit.AjaxRenderKitFactory is blocking ajax in the other web project, if I removed this section, ajax works fine.
I mean by Ajax here, the rendering for
<h:form>
<h:selectOneMenu value="#{myBean.selected}">
<f:selectItem itemValue="#{null}" itemLabel="ABC" />
<f:selectItem itemValue="one" />
<f:selectItem itemValue="two" />
<f:selectItem itemValue="three" />
<f:ajax listener="#{myBean.listener}" render="result" />
</h:selectOneMenu>
<h:outputText id="result" value="#{myBean.selected} #{myBean.result}" />
but the following is working fine
<h:commandButton value="commandButton" action="#{myBean.submit}">
<f:ajax listener="#{myBean.listener}" render="result" />
</h:commandButton>
<h:outputText id="result" value="#{myBean.selected} #{myBean.result}" />
I am not having this com.ibm.faces.renderkit.AjaxRenderKitFactory in my faces-config so why it is affecting Ajax in my project?
The com.ibm.faces.renderkit.AjaxRenderKitFactory is designed to enable ajax support in jurassic JSF 1.x versions which didn't have built-in ajax support.
Since JSF 2.0 (Dec 2009), JSF got built-in ajax support with the new <f:ajax> tag. Therefore, external ajax libraries designed for JSF 1.x such as those from IBM becomes unnecessary and they would possibly even conflict, as you faced.
Just remove it altogether. In JSF 2.x and newer you don't need external libraries to use ajax. Moreover, you should upgrade any JSF 1.x component libraries to a JSF 2.x compatible one.

Spring Multipart/Form-data csrf issue

i've been having issues with csrf validation with a multipart/form-data type of form, since it didnt let me authenticate nor upload my files, returning a 403 when trying to execute the call.
After some reseach i've found that supposedly, "multipart/form-data" forms have trouble with csrf, and thus i had to add the
<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
annotation to each form in my .xhtml file.
(Also tried the form action='', variation)
And yet it kept returning that my csrf value was null
after some more research, i've tried adding the SpringMultipartFilter
<filter>
<display-name>springMultipartFilter</display-name>
<filter-name>springMultipartFilter</filter-name>
<filter-class>org.springframework.web.multipart.support.MultipartFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>springMultipartFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
and also stated the filterMultipartResolver bean in the application context of the presentation part:
<bean id="filterMultipartResolver"
class="org.springframework.web.multipart.commons.CommonsMultipartResolver">
<property name="maxUploadSize" value="-1" />
</bean>
and after doing that, Chrome did let me validate my user, and did let me press the upload button, returning a 200 (OK) code
but, the file is not getting uploaded and debugging shows that my methods are not being called, consoles are not returning an error both Java nor Chrome Debug console, so im a little lost any help to solve or to get actual knowledge of what is happening would be appreciated, thanks.
Im using Spring+Primefaces+Maven.
Upload form in .xhtml:
<h:form id="uploadForm" enctype="multipart/form-data">
<input type="hidden" name="${_csrf.parameterName}"
value="${_csrf.token}" />
<p:fieldset id="uploadBlock"
legend="#{message['cmb.title1.text.label']}">
<br />
<h:panelGroup layout="block"
style="float : left; margin-right : 10%;">
<h:panelGrid id="display1">
<p:fileUpload update=":tableForm:comparisonTable #this"
fileUploadListener="#{ComparisonCSVController.upload}"
allowTypes="/(\.|\/)(csv)$/i" mode="advanced" fileLimit="1"
description="Select a csv file">
</p:fileUpload>
</h:panelGrid>
</h:panelGroup>
</p:fieldset>
<br />
</h:form>
Im certain its not a problem with the actual methods of my beans or my beans, since everything was working till i enabled spring security, and if i turn it off, everything runs smooth, but i need it enabled, so im facing this problem.
Fixed after messing with the order of the filters in the web.xml.
The order has to be:
- Primefaces filter- (i did edit out a FORWARD tag)
- MultiPart filter-
- Spring Filter -
- Prettyfaces filter, with ASYNC tag on-
Thank you.

How to prevent Spring from adding base url again and again (Spring Security)

I've created an application using Spring, Hibernate, tiles, Spring security.
There are pages which can be accessed without logging in. And there are pages which can only be accessed after logging in(i.e. users with the role 'ROLE_USER'). "Account settings" is a page which can be accessed after logging in. When i hit the account settings url without logging in. It takes me directly to login screen. After logging, it redirects me to account settings page. It is the expected behavior. But the problem which i am facing is when i try to hit the link 'account setting' for the second time. It is adding one extra /user in front of the url and I am getting 404 error. How to prevent spring from prefixing user again and again. Even i tried 'redirect' but it didn't help. Your help is highly appreciated.
URL
http://localhost:8080/myapp/user/accountSettings (First time)
http://localhost:8080/myapp/user/user/accountSettings (Second time)
spring-security.xml
<http auto-config="true" use-expressions="true">
<intercept-url pattern="/user/**" access="hasRole('ROLE_USER')" />
.....
Link
&lta href="user/accountSettings"&gtAccount Setting&lt/a&gt
Controller Class
#RequestMapping("/user/accountSettings")
public ModelAndView accountSettings() {
ModelAndView model = new ModelAndView("accountSettings");
return model;
}
tiles.xml
<definition name="accountSettings" extends="base.definition">
<put-attribute name="title" value="Account Settings" />
<put-attribute name="body" value="/WEB-INF/jsp/accountSettings.jsp" />
</definition>
The problem is in the HTML link. You can try
Account Setting
or
Account Setting
Instead of hard-coding your context path, use this
<%# taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
Account Settings
I'd recommend using hyphens in URLs though, like account-settings

Absolute Spring resource reference from a jsp page

I would like to know how to reference a spring resource from a JSP page without either a relative reference, such as ../.., or some cluge to get the context root.
I have this defined:
<mvc:resources mapping="/r/**" location="/resources/" />
In my jsp I would like something like <img src="r/images/image.jpg"/> or
<img src="/r/images/image.jpg"/>
What's the proper way to do this?
Do the following
<spring:url value="/r/images/image.jpg" var="imageUrl" htmlEncoding="true"/>
<img src="${imageUrl}"/>
Note that spring:url is from the Spring Tag Library

Resources