Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot log into H2 Console because of security configuration #14

Open
garsEstTemps opened this issue Nov 3, 2022 · 0 comments
Open

Comments

@garsEstTemps
Copy link

Hi,
I'm learning Spring Boot and I was watching the from zero to hero tutorial where at some point we connect to the H2 console.
I checked the code of this repo out and then created an associated IDEA project easily then started the application.
I wanted to log in H2 console to access the embedded DB but it does not worked. Always ended up in 403 error.

After searches on the web it seems to be a security configuration issue. After reading this article I've updated the io.spring.demo.issuesdashboard.WebSecurityConfig#configure code to be :

		http.csrf().disable(); //Added
		http.headers().frameOptions().disable(); //Added
		http.authorizeRequests()
			.mvcMatchers("/admin").hasRole("ADMIN")
			.requestMatchers(EndpointRequest.to("info", "health")).permitAll()
			.requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ACTUATOR")
			.requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll()
			.antMatchers("/events/**").hasRole("USER")
			.antMatchers("/console/**").permitAll() //Added
			.antMatchers("/**").permitAll()
			.and().httpBasic();

and after restart I was able to connect to the H2 console.

Note that really am a beginner with Spring framework so I will not create a PR since I'm not sure this is the correct and secure way to fix the issue but it definitely seems that there is an issue to access the H2 console with the current code state...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant