Spring Security Ajax login and return

sequence

This article describes how to customize the Login page of Spring Security. Most of the information on the web is outdated and based on back-end template technology, which is not very clear. This article provides a front and back end separation of login and return using Ajax.

Ajax returns

There are three areas that need to be handled: exception handling, which needs to be compatible with Ajax requests, success return handling, and failure return handling.

Ajax exception handling

public class UnauthorizedEntryPoint implements AuthenticationEntryPoint {
    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
        if(isAjaxRequest(request)){
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED,authException.getMessage());
        }else{
            response.sendRedirect("/login.html");
        }

    }

    public static boolean isAjaxRequest(HttpServletRequest request) {
        String ajaxFlag = request.getHeader("X-Requested-With");
        returnajaxFlag ! = null &&"XMLHttpRequest".equals(ajaxFlag); }}Copy the code

Here we’re customizing the ajax returns for success and failure, but here we’re simply going to return statusCode

AjaxAuthSuccessHandler

public class AjaxAuthSuccessHandler extends SimpleUrlAuthenticationSuccessHandler { @Override public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IOException, ServletException { response.setStatus(HttpServletResponse.SC_OK); }}Copy the code

AjaxAuthFailHandler

public class AjaxAuthFailHandler extends SimpleUrlAuthenticationFailureHandler {
    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Authentication failed"); }}Copy the code

Security configuration

@Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Override protected  void configure(HttpSecurity http) throws Exception { http .exceptionHandling().authenticationEntryPoint(new UnauthorizedEntryPoint()) .and() .csrf().disable() .authorizeRequests() .antMatchers("/login"."/css/**"."/js/**"."/fonts/**").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login.html")
                .loginProcessingUrl("/login")
                .usernameParameter("name")
                .passwordParameter("password") .successHandler(new AjaxAuthSuccessHandler()) .failureHandler(new AjaxAuthFailHandler()) .permitAll() .and() .logout()  .logoutUrl("/logout")
                .permitAll();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth
                .inMemoryAuthentication()
                .withUser("admin").password("admin").roles("USER"); }}Copy the code

Here are a few things to note:

• PermitAll adds the front-end resource path and the interface address /login requested by the login form
• LoginPage Sets the address of the login page. In this case, we use the static page, that is, login.html in the static directory
• The Ajax configuration sets authenticationEntryPoint, successHandler, and failureHandler as the custom Ajax processing classes above

The login page

Is a pure HTML page with the following Ajax request for the login button:

$.ajax({
            url: '/login'.type: 'POST',
            data: "name="+name+"&password="+password,
            success: function (res, status) {
                window.location.href='/ok.html'
            },
            error: function(res, status) { dangerDialog(res.statusText); }});Copy the code

This is the request /login path that Spring Security intercepts by default. For those of you who are not familiar with Spring Security, you may wonder if I requested this path, but there is no request mapping for /login in the project. Let’s take a look.

Various filters built into Spring Security:

We need to focus on is the UsernamePasswordAuthenticationFilter here, as the name implies, it is a filter, when executed/login request to intercept, so it is no need to define the login request is in engineering mapping.

UsernamePasswordAuthenticationFilter

Spring ws-security – web – RELEASE 4.2.3 – sources. The jar! /org/springframework/security/web/authentication/UsernamePasswordAuthenticationFilter.java

public class UsernamePasswordAuthenticationFilter extends AbstractAuthenticationProcessingFilter { public Authentication  attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {if(postOnly && ! request.getMethod().equals("POST")) {
            throw new AuthenticationServiceException(
                    "Authentication method not supported: " + request.getMethod());
        }

        String username = obtainUsername(request);
        String password = obtainPassword(request);

        if (username == null) {
            username = "";
        }

        if (password == null) {
            password = "";
        }

        username = username.trim();

        UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
                username, password);

        // Allow subclasses to set the "details" property
        setDetails(request, authRequest);

        returnthis.getAuthenticationManager().authenticate(authRequest); } / /... }Copy the code

Here is the interception, taking the parameters submitted by login.html and passing them to the authenticationManager for authentication. The subsequent filter is followed. If successful, the corresponding session is configured.

doc

• Spring Security dynamically configures URL permissions
• Spring Security Notes: Customize Login/Logout Filter, AuthenticationProvider, AuthenticationToken