Is there a way to "ask" spring security if the current request is secure? Because even if I am authenticated I want to detect if I am in a secure protected URL or in a anonymous / public page
Thanks in advance!
4
-
you mean request including intercept-url pattern or it is ssl authenticated?HRgiger– HRgiger2012-09-02 13:54:13 +00:00Commented Sep 2, 2012 at 13:54
-
i mean intercept-url pattern and secured annotation.user1641877– user16418772012-09-02 21:37:40 +00:00Commented Sep 2, 2012 at 21:37
-
I want to test that the current request I am in, is either anonymous or it has been marked as secured either using a config or using @Secured annotationuser1641877– user16418772012-09-02 21:38:47 +00:00Commented Sep 2, 2012 at 21:38
-
Where you able to resovle this? I'd like to know too if the request URL shall be protected.Michael-O– Michael-O2012-09-27 14:45:27 +00:00Commented Sep 27, 2012 at 14:45
Add a comment
|
3 Answers
Spring Security provides JSP tag support for this. For example:
<sec:authorize url="/admin">
This content will only be visible to users who are authorized to access the "/admin" URL.
</sec:authorize>
Thymeleaf provides a Spring Security Dialect that has direct support for checking URL authorization with Spring Security. For example:
<div sec:authorize-url="/admin">
This will only be displayed if authenticated user can call the "/admin" URL.
</div>
If your technology does not support performing the check directly, you can easily use the WebInvocationPrivilegeEvaluator (this is the object that the JSP taglib and Thymeleaf use). For example, you can @Autowire an instance of WebInvocationPrivilegeEvaluator and use it directly. Obviously the syntax will vary depending on where you use it (i.e. GSP, Freemarker, etc), but here is an example in straight Java code.
@Autowired
WebInvocationPrivilegeEvaluator webPrivs;
public void useIt() {
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
boolean hasAdminAccess = webPrivs.isAllowed("/admin", authentication);
boolean hasAdminPostAccess = webPrivs.isAllowed(null, "/admin", "POST", authentication);
}
2 Comments
Ricardo Vila
This is right but it only works for url patterns defined in spring-security.xml (not for @PreAuthorize annotated controller methods) as i noticed some time ago. You can check this stackoverflow.com/questions/27984557/…
Damian
How can I obtain this WebInvocationPrivilegeEvaluator when I do not use Spring Context?
I think you can use your own implementation for AccessDecisionVoter then just simply override Vote method and compare intercept url using filterInvocation.getRequestUrl(); method.
@Override
public int vote(Authentication authentication, FilterInvocation filterInvocation,
Collection<ConfigAttribute> attributes) {
String requestUrl = filterInvocation.getRequestUrl();
....
}
Comments
We can mark it is as secure channel so converted to https:// url.
<intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" requires-channel="https" />
We can then use request.getScheme() to identify it. I used org.springframework.security.version 3.1.4.RELEASE
