Skip to content
This repository was archived by the owner on May 31, 2022. It is now read-only.
This repository was archived by the owner on May 31, 2022. It is now read-only.

requestMatchers() with permitAll is not working #1539

@vikram06

Description

@vikram06

Hi all,
I am try to given permission for any request. so i have added these code

	http.requestMatchers()
	.antMatchers("/login", "/oauth/authorize").and().authorizeRequests().anyRequest()
	.permitAll().and().formLogin().permitAll()
	.and().csrf().disable().httpBasic().disable();

I got filter chain in my console

o.s.s.web.DefaultSecurityFilterChain     : Creating filter chain: OrRequestMatcher [requestMatchers=[Ant [pattern='/css/**'], Ant [pattern='/js/**'], Ant [pattern='/images/**'], Ant [pattern='/webjars/**'], Ant [pattern='/**/favicon.ico'], Ant [pattern='/error']]], []
2018-12-11 14:51:07.748  INFO 4584 --- [           main] o.s.s.web.DefaultSecurityFilterChain     : Creating filter chain: org.springframework.boot.actuate.autoconfigure.ManagementWebSecurityAutoConfiguration$LazyEndpointPathRequestMatcher@351a39e7, []
2018-12-11 14:51:08.151  INFO 4584 --- [           main] o.s.s.web.DefaultSecurityFilterChain     : Creating filter chain: OrRequestMatcher [requestMatchers=[Ant [pattern='/oauth/token'], Ant [pattern='/oauth/token_key'], Ant [pattern='/oauth/check_token']]], [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@383ce871, org.springframework.security.web.context.SecurityContextPersistenceFilter@60d33834, org.springframework.security.web.header.HeaderWriterFilter@4c16522b, org.springframework.security.web.authentication.logout.LogoutFilter@57ba286d, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@6ba68981, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@618f0ba, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@3278324f, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@4f0e935d, org.springframework.security.web.session.SessionManagementFilter@655e2908, org.springframework.security.web.access.ExceptionTranslationFilter@2bfd3970, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@53a517e9]
2018-12-11 14:51:08.225  INFO 4584 --- [           main] o.s.s.web.DefaultSecurityFilterChain     : Creating filter chain: OrRequestMatcher [requestMatchers=[Ant [pattern='/login'], Ant [pattern='/oauth/authorize']]], [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@7497c5d9, org.springframework.security.web.context.SecurityContextPersistenceFilter@5bfe65df, org.springframework.security.web.header.HeaderWriterFilter@71fcff54, org.springframework.security.web.authentication.logout.LogoutFilter@64c9a84b, org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@595ebb98, org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter@4c31ec8f, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@3b95678b, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@2d0529f2, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@3cce689c, org.springframework.security.web.session.SessionManagementFilter@1fffd548, org.springframework.security.web.access.ExceptionTranslationFilter@36dada39, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@798cf0a0]
2018-12-11 14:51:08.283  INFO 4584 --- [           main] o.s.s.web.DefaultSecurityFilterChain     : Creating filter chain: org.springframework.security.oauth2.config.annotation.web.configuration.ResourceServerConfiguration$NotOAuthRequestMatcher@71e4af7b, [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@72a4b564, org.springframework.security.web.context.SecurityContextPersistenceFilter@574c8a2a, org.springframework.security.web.header.HeaderWriterFilter@6fd0b8ab, org.springframework.security.web.authentication.logout.LogoutFilter@4aecb548, org.springframework.security.oauth2.provider.authentication.OAuth2AuthenticationProcessingFilter@71f164d6, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@4bf30a35, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@218cf600, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@5fde6b8c, org.springframework.security.web.session.SessionManagementFilter@18ae64b5, org.springframework.security.web.access.ExceptionTranslationFilter@722dd1df, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@bc9bd00]
2018-12-11 14:51:08.296  INFO 4584 --- [           main] o.s.s.web.DefaultSecurityFilterChain     : Creating filter chain: OrRequestMatcher [requestMatchers=[Ant [pattern='/**']]], [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@11620d7b, org.springframework.security.web.context.SecurityContextPersistenceFilter@3e010e07, org.springframework.security.web.header.HeaderWriterFilter@653ddea5, org.springframework.security.web.authentication.logout.LogoutFilter@43948dc8, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@7553d28b, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@2f822222, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@24411981, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@4bd4960e, org.springframework.security.web.session.SessionManagementFilter@6ae1ba63, org.springframework.security.web.access.ExceptionTranslationFilter@735c49cc, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@4bcaa38c]

But why i am getting ?

<oauth>
<error_description>
Full authentication is required to access this resource
</error_description>
<error>unauthorized</error>
</oauth>

If i have changed into

     http.authorizeRequests().antMatchers("/login","/oauth/authorize").authenticated()
     .and()
      .authorizeRequests()
      .anyRequest().permitAll()
      .and()
      .formLogin().loginPage("/login").permitAll()
      .and()
      .csrf().disable();

I got

Response : 
Invalid response received.

Thanks in advance.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions