When I add in my websecurityconfig file, I get a 404 error. My Websecurityconfig looks like the following. What is annoying is this works locally but not when deployed. I try to hit the head of my application which I would expect to redirect to the login page but it 404's before logging in

package org.example.demo;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.authentication.configurers.userdetails.DaoAuthenticationConfigurer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.example.demo.LoginSuccessHandler;

import javax.sql.DataSource;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private DataSource dataSource;

    @Bean
    public UserDetailsService userDetailsService() {
        return new CustomUserDetailsService();

    }

    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();

    }

    @Bean
    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
        authenticationProvider.setUserDetailsService(userDetailsService());
        authenticationProvider.setPasswordEncoder(passwordEncoder());

        return authenticationProvider;

    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authenticationProvider());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
                .authorizeRequests()
                .antMatchers("/abc").hasAnyAuthority("ROLE_one")
                .antMatchers("/def").hasAnyAuthority("ROLE_one")
                .antMatchers("/ghi").hasAnyAuthority("ROLE_one")
                .antMatchers("/jkl").hasAnyAuthority("ROLE_one")
                .antMatchers("/mno").hasAnyAuthority("ROLE_one")
                .antMatchers("/pqr").hasAnyAuthority("ROLE_one")
                .antMatchers("/stu").hasAnyAuthority("ROLE_two")
                .antMatchers("/vwx").hasAnyAuthority( "ROLE_two")
                .antMatchers("/yza").hasAnyAuthority("ROLE_two")
                .antMatchers("/bcd").hasAnyAuthority("ROLE_two")
                .antMatchers("/").permitAll()
                .and().formLogin()
                .successHandler(successHandler)
                .and().logout().permitAll();
    }


    @Autowired private LoginSuccessHandler successHandler;


}

I have tried removing it which gets rid of the 404 error but I need the security to be set up.

CodePudding user response：

A 404 means no page has been found for the url you are trying to access. You have the below setting for your HttpSecurity, meaning anyone can access the root of your application and it looks like no page or index.html is defined for it -

.antMatchers("/").permitAll()

Do you have a different package you deploy and locally you have the a page defined for root url which is why you do not see a 404?

CodePudding user response：

turns out I did not have my application.properties file filled out correctly to connect with my database. fixing that fixed the error.

spring.jpa.database-platform=org.hibernate.dialect.MySQL5InnoDBDialect
spring.jpa.hibernate.ddl-auto=create
spring.datasource.driverClassName=com.mysql.cj.jdbc.Driver


spring.datasource.url=jdbc:mysql://localhost:3306/<application_name>
spring.datasource.username=<username>
spring.datasource.password=<password>