Multiple antMatchers in Spring security -


i work on content management system, has 5 antmatchers following:

http.authorizerequests()         .antmatchers("/", "/*.html").permitall()         .antmatchers("/user/**").hasrole("user")         .antmatchers("/admin/**").hasrole("admin")         .antmatchers("/admin/login").permitall()         .antmatchers("/user/login").permitall()         .anyrequest().authenticated()         .and()         .csrf().disable();

which suppose mean visitors can see site @ root path (/*), , users can see (/user), admin can see (/admin), , there 2 login pages 1 users , admin.

the code seems work fine, except admin section - doesn't work return access denied exception.

i believe problem in order of rules:

.antmatchers("/admin/**").hasrole("admin") .antmatchers("/admin/login").permitall()

the order of rules matters , more specific rules should go first. starts /admin require authenticated user admin role, /admin/login path (because /admin/login matched /admin/** rule , therefore second rule ignored).

the rule login page should therefore go before /admin/** rule. e.g.

.antmatchers("/admin/login").permitall() .antmatchers("/admin/**").hasrole("admin")

-

Comments

Post a Comment

Popular posts from this blog

python - Creating a new virtualenv gives a permissions error -

i'm getting following output when running virtualenv newvenv . traceback (most recent call last): file "/usr/local/bin/virtualenv", line 5, in <module> pkg_resources import load_entry_point file "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 2727, in <module> add_activation_listener(lambda dist: dist.activate()) file "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 700, in subscribe callback(dist) file "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 2727, in <lambda> add_activation_listener(lambda dist: dist.activate()) file "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 2227, in activate self.insert_on(path) file "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 2334, in insert_on self.check_version_conflict() file "/usr/lib/python2.7/dist-packages/pkg_resources.py", line 2373, in check_version_conflict...
Read more

facebook - android ACTION_SEND to share with specific application only -

in android application have 4 buttons facebook , viber , telegram , whatsapp , want share different content based on each button. for example if user clicks on viber button want user action_send share content viber only. i found this explains how facebook , twitter seems it's calling specific class name of application don't know applications wanna use except facebook. all android apps have unique id, first have check if these apps installed in user's device , can pass unique id via intent sharing. according below: unique ids different apps : viber : com.viber.voip telegram : org.telegram.messenger whatsapp : com.whatsapp check if these apps installed , if installed send messages through intent. private void sendmessage(context context,string message, string appids) { final boolean isappinstalled =isappavailable(context, appids); if (isappinstalled) { intent myintent = new intent(intent.action_send); myintent.settype("text/p...
Read more

go - Idiomatic way to handle template errors in golang -

say have html/template following: <html> <body> <p>{{somefunc .somedata}}</p> </body> and somefunc returns error. there idiomatic way deal this? if write directly responsewriter , status code 200 has been written before encounter error. var tmpl *template.template func handler(w http.responsewriter, r *http.request) { err := tmpl.execute(w, data) // "<html><body><p>" has been written... // err? } preferably return status code 400 or such, can't see way if use template.execute directly on responsewriter . there i'm missing? since template engine generates output on-the-fly, parts of template preceding somefunc call sent output. , if output not buffered, (along http 200 status) may sent. you can't that. what can perform check before call template.execute() . in trivial case should enough call somefunc() , check return value. if choose path , return value of somefunc() c...
Read more