I managed to log in with the encrypted password and email, but I wanted to create a session with a token and encountered difficulties with this error.
The error from postman:
403 Forbidden
Access to the resource is prohibited.
I have this error in the browser as well as in postman
The error from java :
o.s.security.web.FilterChainProxy : Securing POST /error
o.s.s.w.a.AnonymousAuthenticationFilter : Set SecurityContextHolder to anonymous SecurityContext
o.s.s.w.a.Http403ForbiddenEntryPoint : Pre-authenticated entry point called. Rejecting access
I put code sequences from which I assume the problem is:
public class JwtAuthentificationFilter extends OncePerRequestFilter {
private final JwtUtil jwtUtil;
private final CustomUserDetailsService userService;
@Override
protected void doFilterInternal(@NonNull HttpServletRequest request,
@NonNull HttpServletResponse response,
@NonNull FilterChain filterChain) throws ServletException, IOException {
final String authorizationHeader = request.getHeader("Authorization");
final String jwt;
final String userEmail;
if(authorizationHeader == null || !authorizationHeader.startsWith("Bearer ")) {
filterChain.doFilter(request, response);
return;
}
jwt = authorizationHeader.substring(7);
userEmail=jwtUtil.extractUserName(jwt);
if(userEmail != null && !userEmail.isEmpty() && SecurityContextHolder.getContext().getAuthentication() == null) {
UserDetails userDetails= userService.loadUserByUsername(userEmail);
if(jwtUtil.isValidToken(jwt, userDetails)) {
SecurityContext context = SecurityContextHolder.createEmptyContext();
UsernamePasswordAuthenticationToken authToken =new UsernamePasswordAuthenticationToken(userDetails,
null, userDetails.getAuthorities());
authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
context.setAuthentication(authToken);
SecurityContextHolder.setContext(context);
}
}
filterChain.doFilter(request, response);
}
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http, JwtAuthentificationFilter jwtAuthentificationFilter) throws Exception {
http
.csrf(AbstractHttpConfigurer::disable)
.authorizeHttpRequests(auth ->
auth.requestMatchers("/api/users", "/api/user/**","/api/authenticate").permitAll() // Allow login request
.anyRequest().authenticated()
).sessionManagement(manager->manager.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.authenticationProvider(authenticationProvider())
.addFilterBefore(jwtAuthentificationFilter, UsernamePasswordAuthenticationFilter.class)
.formLogin(AbstractHttpConfigurer::disable) ;// Prevent redirect to login page
return http.build();
}
@Bean
public AuthenticationProvider authenticationProvider() {
DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
authProvider.setUserDetailsService(customUserDetailsService);
authProvider.setPasswordEncoder(passwordEncoder());
return authProvider;
}
@Bean
public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
return config.getAuthenticationManager();
}
I tried to modify the code, I would get the same error no matter what I did. I watched a tutorial being the beginning. I did the same thing and it doesn't work