From ad05eba72608634e4a6ec37a0d4d1a1178aed1b3 Mon Sep 17 00:00:00 2001 From: aven Date: Sat, 8 Oct 2022 19:11:53 -0500 Subject: [PATCH 1/2] WebSecurityConfigurerAdapter is deprecated possible work arounds here https://spring.io/blog/2022/02/21/spring-security-without-the-websecurityconfigureradapter --- click/README.adoc | 34 +++++++++---------- .../java/com/example/SocialApplication.java | 27 ++++++++------- 2 files changed, 31 insertions(+), 30 deletions(-) diff --git a/click/README.adoc b/click/README.adoc index 7440d1f..6ee50f3 100644 --- a/click/README.adoc +++ b/click/README.adoc @@ -79,36 +79,36 @@ WARNING: It's not a great idea to return a whole `OAuth2User` in an endpoint sin There's one final change you'll need to make. This app will now work fine and authenticate as before, but it's still going to redirect before showing the page. -To make the link visible, we also need to switch off the security on the home page by extending `WebSecurityConfigurerAdapter`: +To make the link visible, we also need to switch off the security on the home page by registering a SecurityFilterChain bean: .SocialApplication [source,java] ---- @SpringBootApplication @RestController -public class SocialApplication extends WebSecurityConfigurerAdapter { +public class SocialApplication { // ... - @Override - protected void configure(HttpSecurity http) throws Exception { - // @formatter:off - http - .authorizeRequests(a -> a - .antMatchers("/", "/error", "/webjars/**").permitAll() - .anyRequest().authenticated() - ) - .exceptionHandling(e -> e - .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED)) - ) - .oauth2Login(); - // @formatter:on - } + @Bean + public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { + // @formatter:off + http + .authorizeRequests(a -> a + .antMatchers("/", "/error", "/webjars/**").permitAll() + .anyRequest().authenticated() + ) + .exceptionHandling(e -> e + .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED)) + ) + .oauth2Login(); + return http.build(); + // @formatter:on + } } ---- -Spring Boot attaches special meaning to a `WebSecurityConfigurerAdapter` on the class annotated with `@SpringBootApplication`: It uses it to configure the security filter chain that carries the OAuth 2.0 authentication processor. The above configuration indicates a whitelist of permitted endpoints, with every other endpoint requiring authentication. diff --git a/click/src/main/java/com/example/SocialApplication.java b/click/src/main/java/com/example/SocialApplication.java index 2f3753b..ece4c11 100644 --- a/click/src/main/java/com/example/SocialApplication.java +++ b/click/src/main/java/com/example/SocialApplication.java @@ -22,37 +22,38 @@ import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.http.HttpStatus; import org.springframework.security.config.annotation.web.builders.HttpSecurity; -import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; +import org.springframework.context.annotation.Bean; import org.springframework.security.core.annotation.AuthenticationPrincipal; import org.springframework.security.oauth2.core.user.OAuth2User; +import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.authentication.HttpStatusEntryPoint; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.RestController; @SpringBootApplication @RestController -public class SocialApplication extends WebSecurityConfigurerAdapter { +public class SocialApplication { @GetMapping("/user") public Map user(@AuthenticationPrincipal OAuth2User principal) { return Collections.singletonMap("name", principal.getAttribute("name")); } - @Override - protected void configure(HttpSecurity http) throws Exception { + @Bean + public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { // @formatter:off http - .authorizeRequests(a -> a - .antMatchers("/", "/error", "/webjars/**").permitAll() - .anyRequest().authenticated() - ) - .exceptionHandling(e -> e - .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED)) - ) - .oauth2Login(); + .authorizeRequests(a -> a + .antMatchers("/", "/error", "/webjars/**").permitAll() + .anyRequest().authenticated() + ) + .exceptionHandling(e -> e + .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED)) + ) + .oauth2Login(); + return http.build(); // @formatter:on } - public static void main(String[] args) { SpringApplication.run(SocialApplication.class, args); } From ecadd82a5f8452d1807313245187991e217e813c Mon Sep 17 00:00:00 2001 From: aven Date: Sat, 8 Oct 2022 19:42:49 -0500 Subject: [PATCH 2/2] WebSecurityConfigurerAdapter is deprecated registered filterChain bean and added logout/csrf logic --- logout/README.adoc | 12 ++++++------ .../src/main/java/com/example/SocialApplication.java | 10 ++++++---- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/logout/README.adoc b/logout/README.adoc index f6409a8..d9a236f 100644 --- a/logout/README.adoc +++ b/logout/README.adoc @@ -40,13 +40,13 @@ Now we can switch over to the server side to implement that endpoint. == Adding a Logout Endpoint Spring Security has built in support for a `/logout` endpoint which will do the right thing for us (clear the session and invalidate the cookie). -To configure the endpoint we simply extend the existing `configure()` method in our `WebSecurityConfigurerAdapter`: +To configure the endpoint we simply extend the existing `filterChain()` bean: .SocialApplication.java [source,java] ---- -@Override -protected void configure(HttpSecurity http) throws Exception { +@Bean +public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { // @formatter:off http // ... existing code here @@ -66,13 +66,13 @@ For instance, in Angular, the front end would like the server to send it a cooki We can implement the same behaviour with our simple jQuery client, and then the server-side changes will work with other front end implementations with no or very few changes. To teach Spring Security about this we need to add a filter that creates the cookie. -In the `WebSecurityConfigurerAdapter` we do the following: +In the `filterChain` bean we do the following: .SocialApplication.java [source,java] ---- -@Override -protected void configure(HttpSecurity http) throws Exception { +@Bean +public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { // @formatter:off http // ... existing code here diff --git a/logout/src/main/java/com/example/SocialApplication.java b/logout/src/main/java/com/example/SocialApplication.java index c564ec4..aea93e7 100644 --- a/logout/src/main/java/com/example/SocialApplication.java +++ b/logout/src/main/java/com/example/SocialApplication.java @@ -22,9 +22,10 @@ import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.http.HttpStatus; import org.springframework.security.config.annotation.web.builders.HttpSecurity; -import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; +import org.springframework.context.annotation.Bean; import org.springframework.security.core.annotation.AuthenticationPrincipal; import org.springframework.security.oauth2.core.user.OAuth2User; +import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.authentication.HttpStatusEntryPoint; import org.springframework.security.web.csrf.CookieCsrfTokenRepository; import org.springframework.web.bind.annotation.RequestMapping; @@ -32,15 +33,15 @@ @SpringBootApplication @RestController -public class SocialApplication extends WebSecurityConfigurerAdapter { +public class SocialApplication { @RequestMapping("/user") public Map user(@AuthenticationPrincipal OAuth2User principal) { return Collections.singletonMap("name", principal.getAttribute("name")); } - @Override - protected void configure(HttpSecurity http) throws Exception { + @Bean + public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { // @formatter:off http .authorizeRequests(a -> a @@ -57,6 +58,7 @@ protected void configure(HttpSecurity http) throws Exception { .logoutSuccessUrl("/").permitAll() ) .oauth2Login(); + return http.build(); // @formatter:on }