itzg / spring-security-spa

Provides Spring Security filters and supporting classes that streamline the use of authentication and registration within Single Page web Applications

This library provides Spring Security filters and supporting classes that streamline the use of authentication and registration within Single Page web Applications (SPA).

Installation

Add the jcenter repository to your build, such as

<repository>
  <snapshots>
    <enabled>false</enabled>
  </snapshots>
  <id>jcenter</id>
  <name>jcenter</name>
  <url>https://jcenter.bintray.com</url>
</repository>

and the dependency to this library

<dependency>
  <groupId>me.itzg</groupId>
  <artifactId>spring-security-spa</artifactId>
  <version>1.1.0</version>
</dependency>

Usage

This library provides a pair Spring Security filters that both accept a JSON payload via a POST:

• me.itzg.spring.security.spa.RegistrationFilter
• me.itzg.spring.security.spa.RequestBodyLoginFilter

The JSON payload must contain two fields:

• username
• password

The library also provides SimpleLogoutSuccessHandler in order to conclude the logout process with just a 200 OK status code.

The registration manager needs a UserDetailsManager in order to add the newly registered user. It also needs a PasswordEncoder to encode the registration's new password. The following example shows how to configure the filters in a way that consistently manages those beans between the filters and the Spring security layer.

Example

import me.itzg.spring.security.spa.SinglePageAppConfigurer;
import me.itzg.spring.security.spa.SimpleLogoutSuccessHandler;

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .anyRequest().fullyAuthenticated()

                .and().logout().logoutSuccessHandler(new SimpleLogoutSuccessHandler())
                .and().csrf().disable() // CSRF is less helpful (and a little annoying) with single page apps

                .and().apply(new SinglePageAppConfigurer<>()).registerUrl("/register/local").loginUrl("/login/local")
                ;
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .userDetailsService(userDetailsManager())
                .passwordEncoder(passwordEncoder())
                .and()
                .inMemoryAuthentication();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return PasswordEncoderFactories.createDelegatingPasswordEncoder();
    }

    @Bean
    public UserDetailsManager userDetailsManager() {
        return new InMemoryUserDetailsManager();
    }
}

spring-security-spa's Issues

UserDetailsService support missing

Instead of an InMemoryUserDetailsManager i am using a UserDetailsService implementation since i have some extravagant logic besides just tapping into a database.

This is the error i get:

***************************
APPLICATION FAILED TO START
***************************

Description:

Method springSecurityFilterChain in org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration required a bean of type 'org.springframework.security.provisioning.UserDetailsManager' that could not be found.
	- Bean method 'inMemoryUserDetailsManager' not loaded because @ConditionalOnMissingBean (types: org.springframework.security.authentication.AuthenticationManager,org.springframework.security.authentication.AuthenticationProvider,org.springframework.security.core.userdetails.UserDetailsService; SearchStrategy: all) found beans of type 'org.springframework.security.core.userdetails.UserDetailsService' myUserDetailsService and found beans of type 'org.springframework.security.authentication.AuthenticationProvider' authenticationProvider


Action:

Consider revisiting the conditions above or defining a bean of type 'org.springframework.security.provisioning.UserDetailsManager' in your configuration.

Could a solution be that the RegistrationFilter in the SinglePageAppConfigurer also allows a UserDetailsService instead of just a UserDetailsManager?

registrationFilter.setUserDetailsManager(applicationContext.getBean(UserDetailsManager.class));