java - spring-security with angularjs integration -
i have jersey rest-service i'm using provide data angularjs application. want make of rest methods secure methods under template (myapp/data/**). have spring @repository class users' usernames , passwords. how can achieve this?
i tried like:
@configuration @order(2147483636) @enablewebsecurity public class securityconfiguration extends websecurityconfigureradapter { @autowired private userservice userservice; @override protected void configure(httpsecurity http) throws exception { http.httpbasic().and().authorizerequests() .antmatchers("/rest/**", "/").permitall().anyrequest() .authenticated().and().csrf() .csrftokenrepository(csrftokenrepository()).and() .addfilterafter(csrfheaderfilter(), csrffilter.class) .userdetailsservice(userservice); } private filter csrfheaderfilter() { return new onceperrequestfilter() { @override protected void dofilterinternal(httpservletrequest request, httpservletresponse response, filterchain filterchain) throws servletexception, ioexception { csrftoken csrf = (csrftoken) request.getattribute(csrftoken.class .getname()); if (csrf != null) { cookie cookie = webutils.getcookie(request, "xsrf-token"); string token = csrf.gettoken(); if (cookie == null || token != null && !token.equals(cookie.getvalue())) { cookie = new cookie("xsrf-token", token); cookie.setpath("/"); response.addcookie(cookie); } } filterchain.dofilter(request, response); } }; } private csrftokenrepository csrftokenrepository() { httpsessioncsrftokenrepository repository = new httpsessioncsrftokenrepository(); repository.setheadername("x-xsrf-token"); return repository; } }
but nothing secured without class.
example of 1 of rest-method want secure:
@path("/rest") public class restservice { @get @path("/getentity") @produces("application/json") public response getentity(@queryparam("id") int entityid) { entity e = entityrepository.get(entityid); if (e != null) { response.ok(objectutils.tojson(entity), mediatype.application_json).build(); } return response.servererror().entity("entity + entityid + " not found").build(); }
in order add springsecurityfilterchain context need create springsecurityinitializer
class well:
public class springsecurityinitializer extends abstractsecuritywebapplicationinitializer { //do nothing }
Comments
Post a Comment