Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

custom 403 error page with spring security configured via java code

Anyone knows how to configure a customized 403 page in spring security? Looking in the web, all the results I get it's with XML configuration, and I am using Java configuration. That's my SecurityConfig:

@Configuration
@ComponentScan(value="com")
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return new CustomAuthenticationManager();
    }

    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf()
                .disable()
            .authorizeRequests()
                .antMatchers("/resources/**", "/publico/**").permitAll()
                .anyRequest().authenticated()
                .and()
            .formLogin()
                .loginPage("/acesso/login").permitAll()
                .loginProcessingUrl("/login").permitAll()
                .usernameParameter("login")
                .passwordParameter("senha")
                .successHandler(new CustomAuthenticationSuccessHandler())
                .failureHandler(new CustomAuthenticationFailureHandler())
                .and()
            .logout()
                .logoutUrl("/logout")
                .logoutSuccessUrl("/acesso/login").permitAll();
    }

}

I have a custom implementation for AccessDeniedHandler too:

public class CustomAccessDeniedHandler implements AccessDeniedHandler {

    @Override
    public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException arg2) throws IOException, ServletException {
        response.sendRedirect(request.getContextPath() + "/erro/no_permit");
    }

}
like image 612
Kleber Mota Avatar asked Jun 12 '14 22:06

Kleber Mota


People also ask

How do you handle security exceptions in spring?

Spring security exceptions can be directly handled by adding custom filters and constructing the response body. To handle these exceptions at a global level via @ExceptionHandler and @ControllerAdvice, we need a custom implementation of AuthenticationEntryPoint.

What is a 403 error in Spring Boot?

Spring Security Custom 403 Access Denied Page In Spring security, when an unauthorized user will try to access the secure/ protected page, spring security will throw an access denied exception. There is a default 403 access denied page available with spring security, or if we are using spring boot, it will show the infamous whitelabel error page.

How to handle 403 Access Denied page in Spring Security?

You can put entry for attribute access-denied-handler in spring-security.xml as below. + ", You can not access this page!"); "You can not access this page!"); Please refer to Spring security database authentication for spring-security.xml and other files. You can also use AccessDeniedHandler to handle 403 access denied page.

How do I replace Spring 403 status response page with custom one?

Custom JSP Whenever a user attempts to access a page that is restricted to roles they do not have, the application will return a status code of 403, which means Access Denied. In order to replace the Spring 403 status response page with a custom one, let's first create a JSP file called accessDenied.jsp:

How do I customize the 403 error handling in Java?

Access Denied Page Using Java, we can customize the 403 error handling process by using the accessDeniedPage () or accessDeniedHandler () methods while configuring the HttpSecurity element.


1 Answers

If I'm right, to personalize the page 403, you could use the model implemented by this server.

Spring Security : Customize 403 Access Denied Page

Example:

AppConfig.java

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .authorizeRequests()
            .antMatchers("/resources/**", "/signup").permitAll()
            .anyRequest().authenticated()
            .and()
            .formLogin()
            .loginPage("/login")
            .permitAll()
            .and()
            .exceptionHandling().accessDeniedPage("/403")
            .and()
            .logout().logoutUrl("/logout").logoutSuccessUrl("/")
            .and()
            .rememberMe()
            .and()
            .csrf().disable();
}

HomeController.java

@RequestMapping("/403")
public String accessDenied() {
    return "errors/403";
}

And the .html, would be a custom page with some message 403.

like image 97
Marco López Avatar answered Oct 03 '22 10:10

Marco López