Skip to content

Commit c95ca74

Browse files
mcollovatimcollovati
authored
fix: make sure request principal is available (#22368)
When Spring Security request matchers are executed within SpringPathAccessChecker the request object is a stub instance that throw UnsupportedOperationException for many methods. This can cause failure when the path access checker is used in combination with request matchers that, for example, try to access the request user principal. An example is the pre-configured 'isAllowedHillaView' matcher. This change wraps the request matchers configured by Vaadin so that the request principal is taken from the Spring Security context, if not available on the request. In addition provides documentation and helper to set a global HttpServletRequestTransformer to augment all requests handled by WebInvocationPrivilegeEvaluator with the proper getUserPrincipal method override. Fixes #22284
1 parent 344fd3d commit c95ca74

File tree

10 files changed

+559
-165
lines changed

10 files changed

+559
-165
lines changed

‎flow-tests/vaadin-spring-tests/test-spring-security-flow-routepathaccesschecker/pom.xml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -182,6 +182,9 @@
182182
<groupId>com.vaadin</groupId>
183183
<artifactId>flow-maven-plugin</artifactId>
184184
<version>${project.version}</version>
185+
<configuration>
186+
<frontendHotdeploy>false</frontendHotdeploy>
187+
</configuration>
185188
<executions>
186189
<execution>
187190
<goals>

‎flow-tests/vaadin-spring-tests/test-spring-security-flow-routepathaccesschecker/src/main/java/com/vaadin/flow/spring/flowsecurity/SecurityConfig.java‎

Lines changed: 57 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,38 @@
11
package com.vaadin.flow.spring.flowsecurity;
22

3+
import com.vaadin.flow.component.UI;
4+
import com.vaadin.flow.internal.UrlUtil;
5+
import com.vaadin.flow.internal.hilla.FileRouterRequestUtil;
6+
import com.vaadin.flow.spring.RootMappedCondition;
7+
import com.vaadin.flow.spring.VaadinConfigurationProperties;
8+
import com.vaadin.flow.spring.flowsecurity.data.UserInfo;
9+
import com.vaadin.flow.spring.flowsecurity.service.UserInfoService;
10+
import com.vaadin.flow.spring.flowsecurity.views.LoginView;
11+
import com.vaadin.flow.spring.security.NavigationAccessControlConfigurer;
12+
import com.vaadin.flow.spring.security.VaadinAwareSecurityContextHolderStrategyConfiguration;
13+
import com.vaadin.flow.spring.security.VaadinSecurityConfigurer;
314
import jakarta.servlet.ServletContext;
4-
5-
import java.util.stream.Collectors;
6-
715
import org.springframework.beans.factory.annotation.Autowired;
816
import org.springframework.context.annotation.Bean;
917
import org.springframework.context.annotation.Configuration;
18+
import org.springframework.context.annotation.Import;
1019
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
1120
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
1221
import org.springframework.security.core.authority.SimpleGrantedAuthority;
1322
import org.springframework.security.core.userdetails.User;
1423
import org.springframework.security.core.userdetails.UserDetails;
1524
import org.springframework.security.core.userdetails.UsernameNotFoundException;
1625
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
26+
import org.springframework.security.web.SecurityFilterChain;
1727

18-
import com.vaadin.flow.component.UI;
19-
import com.vaadin.flow.internal.UrlUtil;
20-
import com.vaadin.flow.spring.RootMappedCondition;
21-
import com.vaadin.flow.spring.VaadinConfigurationProperties;
22-
import com.vaadin.flow.spring.flowsecurity.data.UserInfo;
23-
import com.vaadin.flow.spring.flowsecurity.service.UserInfoService;
24-
import com.vaadin.flow.spring.flowsecurity.views.LoginView;
25-
import com.vaadin.flow.spring.security.NavigationAccessControlConfigurer;
26-
import com.vaadin.flow.spring.security.VaadinWebSecurity;
28+
import java.util.stream.Collectors;
2729

2830
import static com.vaadin.flow.spring.flowsecurity.service.UserInfoService.ROLE_ADMIN;
2931

3032
@EnableWebSecurity
3133
@Configuration
32-
public class SecurityConfig extends VaadinWebSecurity {
34+
@Import(VaadinAwareSecurityContextHolderStrategyConfiguration.class)
35+
public class SecurityConfig {
3336

3437
@Autowired
3538
private UserInfoService userInfoService;
@@ -46,6 +49,21 @@ static NavigationAccessControlConfigurer navigationAccessControlConfigurer() {
4649
.withRoutePathAccessChecker();
4750
}
4851

52+
/*
53+
* Simulates Hilla implementation that accesses request principal.
54+
*/
55+
@Bean
56+
FileRouterRequestUtil sutbFileRouterRequestUtil() {
57+
return request -> {
58+
var principal = request.getUserPrincipal();
59+
if (principal != null) {
60+
// do nothing, just prevent IDE from complaining about unused
61+
// variable
62+
}
63+
return false;
64+
};
65+
}
66+
4967
public String getLogoutSuccessUrl() {
5068
String logoutSuccessUrl;
5169
String mapping = vaadinConfigurationProperties.getUrlMapping();
@@ -61,42 +79,35 @@ public String getLogoutSuccessUrl() {
6179
return logoutSuccessUrl;
6280
}
6381

64-
@Override
65-
public void configure(HttpSecurity http) throws Exception {
66-
// @formatter:off
82+
@Bean
83+
SecurityFilterChain vaadinSecurityFilterChain(HttpSecurity http)
84+
throws Exception {
6785
http.authorizeHttpRequests(cfg -> cfg
68-
.requestMatchers(antMatchers("/admin-only/**", "/admin"))
69-
.hasAnyRole(ROLE_ADMIN)
70-
.requestMatchers(antMatchers("/private"))
71-
.authenticated()
72-
.requestMatchers(antMatchers("/", "/public/**", "/another", "/menu-list"))
73-
.permitAll()
74-
.requestMatchers(antMatchers("/error"))
75-
.permitAll()
86+
.requestMatchers("/admin-only/**", "/admin")
87+
.hasAnyRole(ROLE_ADMIN).requestMatchers("/private")
88+
.authenticated()
89+
.requestMatchers("/", "/public/**", "/another", "/menu-list")
90+
.permitAll().requestMatchers("/error").permitAll()
7691
// routes aliases
77-
.requestMatchers(antMatchers("/alias-for-admin"))
78-
.hasAnyRole(ROLE_ADMIN)
79-
.requestMatchers(antMatchers("/home", "/hey/**"))
80-
.permitAll()
81-
.requestMatchers(antMatchers("/all-logged-in/**"))
82-
.authenticated()
83-
);
92+
.requestMatchers("/alias-for-admin").hasAnyRole(ROLE_ADMIN)
93+
.requestMatchers("/home", "/hey/**").permitAll()
94+
.requestMatchers("/all-logged-in/**").authenticated());
8495
// @formatter:on
85-
86-
super.configure(http);
87-
if (getLogoutSuccessUrl().equals("/")) {
88-
// Test the default url with empty context path
89-
setLoginView(http, LoginView.class);
90-
} else {
91-
setLoginView(http, LoginView.class, getLogoutSuccessUrl());
92-
}
93-
http.logout(cfg -> cfg
94-
.addLogoutHandler((request, response, authentication) -> {
95-
UI ui = UI.getCurrent();
96-
ui.accessSynchronously(() -> ui.getPage()
97-
.setLocation(UrlUtil.getServletPathRelative(
98-
getLogoutSuccessUrl(), request)));
99-
}));
96+
http.with(VaadinSecurityConfigurer.vaadin(), vaadin -> {
97+
if (getLogoutSuccessUrl().equals("/")) {
98+
// Test the default url with empty context path
99+
vaadin.loginView(LoginView.class);
100+
} else {
101+
vaadin.loginView(LoginView.class, getLogoutSuccessUrl());
102+
}
103+
vaadin.addLogoutHandler((request, response, authentication) -> {
104+
UI ui = UI.getCurrent();
105+
ui.accessSynchronously(() -> ui.getPage().setLocation(
106+
UrlUtil.getServletPathRelative(getLogoutSuccessUrl(),
107+
request)));
108+
});
109+
});
110+
return http.build();
100111
}
101112

102113
@Bean

‎flow-tests/vaadin-spring-tests/test-spring-security-flow-routepathaccesschecker/src/main/java/com/vaadin/hilla/EndpointController.java‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
/*
2+
* Copyright 2000-2025 Vaadin Ltd.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License"); you may not
5+
* use this file except in compliance with the License. You may obtain a copy of
6+
* the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12+
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13+
* License for the specific language governing permissions and limitations under
14+
* the License.
15+
*
16+
*/
17+
18+
package com.vaadin.hilla;
19+
20+
// Stub class to simulate the presence of Hilla
21+
class EndpointController {
22+
}

‎flow-tests/vaadin-spring-tests/test-spring-security-flow-standalone-routepathaccesschecker/src/main/java/com/vaadin/flow/spring/flowsecurity/SecurityConfig.java‎

Lines changed: 78 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,19 @@
11
package com.vaadin.flow.spring.flowsecurity;
22

3+
import com.vaadin.flow.component.UI;
4+
import com.vaadin.flow.internal.UrlUtil;
5+
import com.vaadin.flow.server.HandlerHelper;
6+
import com.vaadin.flow.spring.RootMappedCondition;
7+
import com.vaadin.flow.spring.VaadinConfigurationProperties;
8+
import com.vaadin.flow.spring.flowsecurity.data.UserInfo;
9+
import com.vaadin.flow.spring.flowsecurity.service.UserInfoService;
10+
import com.vaadin.flow.spring.flowsecurity.views.LoginView;
11+
import com.vaadin.flow.spring.security.AuthenticationContext;
12+
import com.vaadin.flow.spring.security.NavigationAccessControlConfigurer;
13+
import com.vaadin.flow.spring.security.RequestUtil;
14+
import com.vaadin.flow.spring.security.SpringAccessPathChecker;
15+
import com.vaadin.flow.spring.security.UidlRedirectStrategy;
316
import jakarta.servlet.ServletContext;
4-
import java.util.stream.Collectors;
5-
617
import org.springframework.beans.factory.annotation.Autowired;
718
import org.springframework.boot.security.autoconfigure.servlet.PathRequest;
819
import org.springframework.context.annotation.Bean;
@@ -15,22 +26,17 @@
1526
import org.springframework.security.core.userdetails.UserDetails;
1627
import org.springframework.security.core.userdetails.UsernameNotFoundException;
1728
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
29+
import org.springframework.security.web.DefaultSecurityFilterChain;
1830
import org.springframework.security.web.SecurityFilterChain;
31+
import org.springframework.security.web.access.AuthorizationManagerWebInvocationPrivilegeEvaluator;
32+
import org.springframework.security.web.access.PathPatternRequestTransformer;
33+
import org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler;
1934

20-
import com.vaadin.flow.component.UI;
21-
import com.vaadin.flow.internal.UrlUtil;
22-
import com.vaadin.flow.spring.RootMappedCondition;
23-
import com.vaadin.flow.spring.VaadinConfigurationProperties;
24-
import com.vaadin.flow.spring.flowsecurity.data.UserInfo;
25-
import com.vaadin.flow.spring.flowsecurity.service.UserInfoService;
26-
import com.vaadin.flow.spring.flowsecurity.views.LoginView;
27-
import com.vaadin.flow.spring.security.AuthenticationContext;
28-
import com.vaadin.flow.spring.security.NavigationAccessControlConfigurer;
29-
import com.vaadin.flow.spring.security.RequestUtil;
35+
import java.security.Principal;
36+
import java.util.stream.Collectors;
3037

3138
import static com.vaadin.flow.spring.flowsecurity.service.UserInfoService.ROLE_ADMIN;
3239
import static com.vaadin.flow.spring.security.RequestUtil.antMatchers;
33-
import static com.vaadin.flow.spring.security.VaadinSecurityConfigurer.vaadin;
3440

3541
@EnableWebSecurity
3642
@Configuration
@@ -58,54 +64,87 @@ public AuthenticationContext authenticationContext() {
5864
@Bean
5965
static NavigationAccessControlConfigurer navigationAccessControlConfigurer() {
6066
return new NavigationAccessControlConfigurer()
61-
.withRoutePathAccessChecker();
67+
.withLoginView(LoginView.class).withRoutePathAccessChecker();
68+
}
69+
70+
@Bean
71+
AuthorizationManagerWebInvocationPrivilegeEvaluator.HttpServletRequestTransformer customRequestTransformer() {
72+
return SpringAccessPathChecker.principalAwareRequestTransformer(
73+
new PathPatternRequestTransformer());
6274
}
6375

6476
@Bean
6577
public SecurityFilterChain webFilterChain(HttpSecurity http,
6678
AuthenticationContext authenticationContext) throws Exception {
6779
// Setup
6880
http.csrf(AbstractHttpConfigurer::disable); // simple for testing
69-
// purpose
81+
// purpose
7082

7183
// Homemade security for Vaadin application, not fully functional as the
7284
// configuration provided by VaadinWebSecurity
7385
// @formatter:off
7486
http.authorizeHttpRequests(auth -> auth
87+
// Ensures that SpringPathAccessChecker does not fail when matchers get Principal from HTTP request
88+
.requestMatchers(request -> {
89+
Principal principal = request.getUserPrincipal();
90+
if (principal == null) {
91+
// Do nothing, just avoid IDE complain about not used variable
92+
}
93+
return false; // no need to match rule, we just want to access principal.
94+
}).denyAll()
7595
// Permit access to static resources
7696
.requestMatchers(PathRequest.toStaticResources().atCommonLocations())
77-
.permitAll()
97+
.permitAll()
98+
// Permit access to vaadin's internal communication
99+
.requestMatchers(request -> HandlerHelper
100+
.isFrameworkInternalRequest("/*", request))
101+
.permitAll()
102+
.requestMatchers(requestUtil::isAnonymousRoute)
103+
.permitAll()
104+
// Permit technical access to vaadin's static files
105+
.requestMatchers("/VAADIN/**").permitAll()
106+
// custom request matchers. using 'routeAwareAntMatcher' to
107+
// allow checking route and alias paths against patterns
78108
.requestMatchers(antMatchers("/admin-only/**", "/admin"))
79-
.hasAnyRole(ROLE_ADMIN)
109+
.hasAnyRole(ROLE_ADMIN)
80110
.requestMatchers(antMatchers("/private"))
81-
.authenticated()
111+
.authenticated()
82112
.requestMatchers(antMatchers("/", "/public/**", "/another"))
83-
.permitAll()
113+
.permitAll()
84114

85115
.requestMatchers(antMatchers("/error"))
86-
.permitAll()
116+
.permitAll()
87117
// routes aliases
88118
.requestMatchers(antMatchers("/alias-for-admin"))
89-
.hasAnyRole(ROLE_ADMIN)
119+
.hasAnyRole(ROLE_ADMIN)
90120
.requestMatchers(antMatchers("/home", "/hey/**"))
91-
.permitAll()
92-
.requestMatchers(antMatchers("/all-logged-in/**"))
93-
.authenticated()
94-
);
121+
.permitAll()
122+
.requestMatchers(antMatchers("/all-logged-in/**", "/passthrough/**"))
123+
.authenticated()
124+
);
95125
// @formatter:on
96-
http.with(vaadin(),
97-
cfg -> cfg.loginView(LoginView.class, getLogoutSuccessUrl())
98-
.addLogoutHandler(
99-
(request, response, authentication) -> {
100-
UI ui = UI.getCurrent();
101-
ui.accessSynchronously(() -> ui.getPage()
102-
.setLocation(UrlUtil
103-
.getServletPathRelative(
104-
getLogoutSuccessUrl(),
105-
request)));
106-
}));
107-
108-
return http.build();
126+
http.logout(cfg -> {
127+
SimpleUrlLogoutSuccessHandler logoutSuccessHandler = new SimpleUrlLogoutSuccessHandler();
128+
logoutSuccessHandler.setDefaultTargetUrl(getLogoutSuccessUrl());
129+
logoutSuccessHandler
130+
.setRedirectStrategy(new UidlRedirectStrategy());
131+
cfg.logoutSuccessHandler(logoutSuccessHandler);
132+
cfg.addLogoutHandler((request, response, authentication) -> {
133+
UI ui = UI.getCurrent();
134+
ui.accessSynchronously(() -> ui.getPage().setLocation(
135+
UrlUtil.getServletPathRelative(getLogoutSuccessUrl(),
136+
request)));
137+
});
138+
});
139+
// Custom login page with form authentication
140+
http.formLogin(cfg -> cfg.loginPage("/my/login/page").permitAll());
141+
DefaultSecurityFilterChain filterChain = http.build();
142+
// Test application uses AuthenticationContext, configure it with
143+
// the logout handlers
144+
AuthenticationContext.applySecurityConfiguration(http,
145+
authenticationContext);
146+
147+
return filterChain;
109148
}
110149

111150
public String getLogoutSuccessUrl() {
@@ -145,4 +184,4 @@ public UserDetails loadUserByUsername(String username)
145184
};
146185
}
147186

148-
}
187+
}

0 commit comments

Comments
 (0)