spring security: http if user not authenticate

Question

I'm using Spring 3.2 + primefaces 3.5 + hibernate 4.1.9 The security context is:



<http auto-config='false' use-expressions="true"   >
    <intercept-url pattern="/**/login"  access="permitAll" requires-channel="https"/>
    <intercept-url pattern="/**/registration" access="permitAll" requires-channel="https" />
    <intercept-url pattern="/**/cart" access="permitAll" requires-channel="https"  />
    <intercept-url pattern="/**/cart/**" access="hasAnyRole('USER','ADMIN')" requires-channel="https" />
    <intercept-url pattern="/pages/adm/**" access="hasRole('ADMIN')" requires-channel="https" />
    <intercept-url pattern="/*/account**" access="hasAnyRole('USER','ADMIN')" requires-channel="https" />
    <intercept-url pattern="/**" requires-channel="any" />

    <form-login login-page="/loginRedirect"             
        authentication-failure-handler-ref="pennyUrlAuthenticationFailureHandler"
        authentication-success-handler-ref="pennyAuthSuccessHandler"
        default-target-url="/pages/account/orders.xhtml" />
    <logout logout-success-url="/"  invalidate-session="true"/>
</http>

If I go to a page that requires HTTPS, for the rest of session, it will use the HTTPS protocol, even if the user is not authenticated. If I go to https ://mystite/en/cart, HTTPS will be used for all browsing session.

I do not want to switch HTTPS to HTTP forever, but only if the user is not authenticated. Can I force the HTTP for non-authenticated users?

Marcel Stör · Accepted Answer · 2013-05-27 11:20:14Z

1

If I go to a page that requires HTTPS, for the rest of session, it will use the HTTPS protocol, even if the user is not authenticated.

That's correct because of

<intercept-url pattern="/**/cart/**" access="hasAnyRole('USER','ADMIN')" requires-channel="https" />

Also, because of

<intercept-url pattern="/**" requires-channel="any" />

it will stick with HTTPS once the user requested a resource that requires HTTPS. Why would it have to switch back if you say any (HTTPS is as good as any)?

Can I force the HTTP for non-authenticated users?

No, not that I know of. Personally, I don't think this would make much sense either.

answered May 27, 2013 at 11:20

Marcel Stör

23.8k20 gold badges107 silver badges218 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

spring security: http if user not authenticate

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related