Skip to content

Commit cc1d64f

Browse files
mshabarovtltv
mshabarov
and
tltv
authored
feat!: Restrict access by default with Spring Security (#21831)
* chore!: Restrict access by default with Spring Security * add new test and fix existing tests * Require auth for PermitAll/RolesAllowed routes Flow routes with PermitAll or RolesAllowed annotation are checked by default with `.requestMatchers(requestUtil::isAuthenticatedRoute).authenticated()`. checkForBrowserErrors method in AbstractIT allows now 403 error for various tests. * Updated more ITs for deny by default Keeping 'routepathaccesschecker' in purpose using deprecated VaadinWebSecurity for now. * Updated even more ITs for deny by default * Update RequestUtil.isAuthenticatedRouteInternal(HttpServletRequest) Added check for parent layouts and auto-layout. * Apply authenticated() for all flow views All flow views are configured with authenticated() rule, not just PermitAll and RolesAllowed annotated routes. This will ensure that all configured access checkers are triggered for not-annotated views too. * Add NAC enabled check * Refactor by code review findings * Resolve conflicts after rebase * Fix compilation error * Add isSecuredFlowRouteInternal and refactor isFlowRouteInternal --------- Co-authored-by: Tomi Virtanen <tltv@vaadin.com>
1 parent 8bfe7ab commit cc1d64f

File tree

20 files changed

+376
-38
lines changed

20 files changed

+376
-38
lines changed

‎flow-tests/vaadin-spring-tests/test-spring-security-flow-routepathaccesschecker/src/main/java/com/vaadin/flow/spring/flowsecurity/SecurityConfig.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,8 @@ public void configure(HttpSecurity http) throws Exception {
7878
.hasAnyRole(ROLE_ADMIN)
7979
.requestMatchers(antMatchers("/home", "/hey/**"))
8080
.permitAll()
81+
.requestMatchers(antMatchers("/all-logged-in/**"))
82+
.authenticated()
8183
);
8284
// @formatter:on
8385

‎flow-tests/vaadin-spring-tests/test-spring-security-flow-routepathaccesschecker/src/main/java/com/vaadin/flow/spring/flowsecurity/views/PassThroughView.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,15 @@
1616

1717
package com.vaadin.flow.spring.flowsecurity.views;
1818

19+
import jakarta.annotation.security.PermitAll;
20+
1921
import com.vaadin.flow.component.html.Div;
2022
import com.vaadin.flow.router.BeforeEnterEvent;
2123
import com.vaadin.flow.router.BeforeEnterObserver;
2224
import com.vaadin.flow.router.Route;
2325

2426
@Route(value = "passthrough/:type(forward|reroute)")
27+
@PermitAll
2528
public class PassThroughView extends Div implements BeforeEnterObserver {
2629

2730
@Override

‎flow-tests/vaadin-spring-tests/test-spring-security-flow-routepathaccesschecker/src/main/resources/static/restricted/secret.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Top secret restricted content

‎flow-tests/vaadin-spring-tests/test-spring-security-flow-routepathaccesschecker/src/test/java/com/vaadin/flow/spring/flowsecurity/AbstractIT.java

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,9 @@ public void tearDown() {
4444

4545
private void checkForBrowserErrors() {
4646
checkLogsForErrors(msg -> msg.contains(
47-
"admin-only/secret.txt - Failed to load resource: the server responded with a status of 403")
47+
"restricted/secret.txt?continue - Failed to load resource: the server responded with a status of 403")
48+
|| msg.contains(
49+
"admin-only/secret.txt - Failed to load resource: the server responded with a status of 403")
4850
|| msg.contains(
4951
"admin-only/secret.txt?continue - Failed to load resource: the server responded with a status of 403")
5052
|| (msg.contains("X-Atmosphere-Transport=close")

‎flow-tests/vaadin-spring-tests/test-spring-security-flow-routepathaccesschecker/src/test/java/com/vaadin/flow/spring/flowsecurity/AppViewIT.java

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,25 @@ public void access_restricted_to_logged_in_users() {
176176
assertLoginViewShown();
177177
}
178178

179+
@Test
180+
public void access_restricted_to_all_by_default() {
181+
String path = "restricted/secret.txt";
182+
183+
openResource(path);
184+
assertLoginViewShown();
185+
loginUser();
186+
assertForbiddenPage();
187+
logout();
188+
189+
openResource(path);
190+
loginAdmin();
191+
assertForbiddenPage();
192+
logout();
193+
194+
openResource(path);
195+
assertLoginViewShown();
196+
}
197+
179198
@Test
180199
public void access_restricted_to_admin() {
181200
String contents = "Secret document for admin";

‎flow-tests/vaadin-spring-tests/test-spring-security-flow-standalone-routepathaccesschecker/src/main/java/com/vaadin/flow/spring/flowsecurity/SecurityConfig.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,8 @@ public SecurityFilterChain webFilterChain(HttpSecurity http,
8989
.hasAnyRole(ROLE_ADMIN)
9090
.requestMatchers(antMatchers("/home", "/hey/**"))
9191
.permitAll()
92+
.requestMatchers(antMatchers("/all-logged-in/**"))
93+
.authenticated()
9294
);
9395
// @formatter:on
9496
http.with(vaadin(),

‎flow-tests/vaadin-spring-tests/test-spring-security-flow-standalone-routepathaccesschecker/src/main/java/com/vaadin/flow/spring/flowsecurity/views/PassThroughView.java

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,15 @@
1616

1717
package com.vaadin.flow.spring.flowsecurity.views;
1818

19+
import jakarta.annotation.security.PermitAll;
20+
1921
import com.vaadin.flow.component.html.Div;
2022
import com.vaadin.flow.router.BeforeEnterEvent;
2123
import com.vaadin.flow.router.BeforeEnterObserver;
2224
import com.vaadin.flow.router.Route;
2325

2426
@Route(value = "passthrough/:type(forward|reroute)")
27+
@PermitAll
2528
public class PassThroughView extends Div implements BeforeEnterObserver {
2629

2730
@Override

‎flow-tests/vaadin-spring-tests/test-spring-security-flow-standalone-routepathaccesschecker/src/main/resources/static/restricted/secret.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Top secret restricted content

‎flow-tests/vaadin-spring-tests/test-spring-security-flow-standalone-routepathaccesschecker/src/test/java/com/vaadin/flow/spring/flowsecurity/AbstractIT.java

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,9 @@ public void tearDown() {
4444

4545
private void checkForBrowserErrors() {
4646
checkLogsForErrors(msg -> msg.contains(
47-
"admin-only/secret.txt - Failed to load resource: the server responded with a status of 403")
47+
"restricted/secret.txt?continue - Failed to load resource: the server responded with a status of 403")
48+
|| msg.contains(
49+
"admin-only/secret.txt - Failed to load resource: the server responded with a status of 403")
4850
|| msg.contains(
4951
"admin-only/secret.txt?continue - Failed to load resource: the server responded with a status of 403")
5052
|| (msg.contains("X-Atmosphere-Transport=close")

‎flow-tests/vaadin-spring-tests/test-spring-security-flow-standalone-routepathaccesschecker/src/test/java/com/vaadin/flow/spring/flowsecurity/AppViewIT.java

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,25 @@ public void access_restricted_to_logged_in_users() {
178178
assertLoginViewShown();
179179
}
180180

181+
@Test
182+
public void access_restricted_to_all_by_default() {
183+
String path = "restricted/secret.txt";
184+
185+
openResource(path);
186+
assertLoginViewShown();
187+
loginUser();
188+
assertForbiddenPage();
189+
logout();
190+
191+
openResource(path);
192+
loginAdmin();
193+
assertForbiddenPage();
194+
logout();
195+
196+
openResource(path);
197+
assertLoginViewShown();
198+
}
199+
181200
@Test
182201
public void access_restricted_to_admin() {
183202
String contents = "Secret document for admin";

0 commit comments

Comments
 (0)