I'm currently developing a Web Application using Spring (with Spring Security) and Vue.js. I've built some Web Applications before but they are just for school purposes so they're mostly incomplete when it comes to Authentication and Authorization. So, as you can see, I'm really unexperienced when it comes to Spring Boot and Spring Security stuff.
My project is setup the following way:
project-folder
- project-server (Spring -> localhost:9000)
- project-web (Vue.js CLI -> localhost:8080)
I was following a tutorial to implement Spring Security and, right now, I can use the built-in Login form to authenticate my User with the credentials I have stored in my MySQL database.
The problem is I don't want to use this Login Page and I want to create my own in my frontend project. I've looked it up and I can change the Login Page but I believe it needs to be in my resources folder inside my backend project folders. However, my project isn't set up this way and I'd rather not change it (if possible). I thought I could just reference my API through the URL but I noticed Spring Security does not send a HTTP 200 Response when Login succeeds but instead sends a HTTP 302 Redirect Response. I've seen solutions that disable the form login and then use JWT's for authentication but I've also seen that it's not a good practice because there's no way to revoke this token.
Here's how my ApplicationSecurityConfig looks
@Configuration
@EnableWebSecurity
public class ApplicationSecurityConfig extends WebSecurityConfigurerAdapter {
private final PasswordEncoder passwordEncoder;
private final ApplicationUserService applicationUserService;
@Autowired
public ApplicationSecurityConfig(PasswordEncoder passwordEncoder,
ApplicationUserService applicationUserService) {
this.passwordEncoder = passwordEncoder;
this.applicationUserService = applicationUserService;
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.authorizeRequests()
.antMatchers("/", "/css/*", "/js/*").permitAll()
.anyRequest()
.authenticated()
.and()
.formLogin()
.usernameParameter("email")
.and()
.logout()
.logoutUrl("/logout")
.logoutRequestMatcher(new AntPathRequestMatcher("/logout", "GET"))
.clearAuthentication(true)
.invalidateHttpSession(true)
.deleteCookies("JSESSIONID", "remember-me")
.logoutSuccessUrl("/login");
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth
.userDetailsService(applicationUserService)
.passwordEncoder(passwordEncoder);
}
}
So, is there a way to create an external login page and use Spring Security authentication and authorization features?