Spring Security Configuraion Issue : Permit All Not working #14011

dv0892 · 2023-10-13T14:37:37Z

I am configuring a bean of type SecurityFilterChain in a very simple spring boot application with jsp .

URI's like / or /welcome should be accessible by anyone

But URI /authenticate or any other request should require authentication

Here is Security Config

@Bean
	public SecurityFilterChain filterChain( HttpSecurity http , MvcRequestMatcher.Builder mvc) throws Exception {		
            http.csrf(AbstractHttpConfigurer::disable)
		.authorizeHttpRequests(auth -> 
			auth.requestMatchers(mvc.pattern("/"),mvc.pattern("/welcome")).permitAll()
			.anyRequest().authenticated()
			)
		.formLogin(Customizer.withDefaults())
		.httpBasic(Customizer.withDefaults());

		return http.build();
	}

But it is asking me to login to every URI pattern including / and /welcome.

I have attached my sample repository on which I am facing this issue
https://github.com/dv0892/Security-Sample/tree/master

Seems like permitAll() is not working.
Please let me know if anything else is required

The text was updated successfully, but these errors were encountered:

chipbk10 · 2023-10-14T06:28:13Z

I got the same issue

marcusdacoregio · 2023-10-16T17:18:25Z

Hi, @dv0892. Have you enabled TRACE logging to check where the authentication error is happening? Have you enabled the FORWARD dispatcher type?

chipbk10 · 2023-10-17T13:02:42Z

yes. Please look at the simple code below. You can reproduce it easily.

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        return http
                .csrf(CsrfConfigurer::disable)
                .authorizeHttpRequests(requests -> requests
                        .requestMatchers("/home").permitAll()
                )
                .formLogin(withDefaults())
                .build();
    }
}

@Controller
public class AuthController {
    @GetMapping("/home")
    public String home() {
        return "Home Page";
    }
}

marcusdacoregio · 2023-10-17T13:06:12Z

I don't see you allowing FORWARD and neither you provided any logs that can help to know what is happening. Please, try what I recommended, and, if you really believe that there is a bug in Spring Security, please create a minimal, reproducible sample and write your findings.

chipbk10 · 2023-10-17T13:12:29Z

@dv0892 has created a sample project that can reproduce this issue: https://github.com/dv0892/Security-Sample/tree/master

Can you provide the code to do the FORWARD like you mention? Thanks

chipbk10 · 2023-10-20T14:11:58Z

Even I have enabled the FORWARD Dispatcher Type, it's still not working. Enter localhost:8080/home, it still asks for login:

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        return http
                .csrf(CsrfConfigurer::disable)
                .authorizeHttpRequests(requests -> requests
                        .dispatcherTypeMatchers(DispatcherType.FORWARD, DispatcherType.ERROR).permitAll()
                        .requestMatchers("/home").permitAll()
                        .anyRequest().denyAll()
                )

                .formLogin(withDefaults())
                .build();
    }
}

@Controller
public class AuthController {
    @GetMapping("/home")
    public String home() {
        return "Home Page";
    }
}

xtyuns · 2023-10-22T08:37:34Z

I am configuring a bean of type SecurityFilterChain in a very simple spring boot application with jsp .

URI's like / or /welcome should be accessible by anyone

But URI /authenticate or any other request should require authentication

Here is Security Config
@Bean
	public SecurityFilterChain filterChain( HttpSecurity http , MvcRequestMatcher.Builder mvc) throws Exception {		
            http.csrf(AbstractHttpConfigurer::disable)
		.authorizeHttpRequests(auth -> 
			auth.requestMatchers(mvc.pattern("/"),mvc.pattern("/welcome")).permitAll()
			.anyRequest().authenticated()
			)
		.formLogin(Customizer.withDefaults())
		.httpBasic(Customizer.withDefaults());

		return http.build();
	}
But it is asking me to login to every URI pattern including / and /welcome.

I have attached my sample repository on which I am facing this issue https://github.com/dv0892/Security-Sample/tree/master

Seems like permitAll() is not working. Please let me know if anything else is required

I think it's not a good idea to mix springboot and jsp together.This is also the main problem in this issue besides forward.

chipbk10 · 2023-10-22T18:54:43Z

Finally, I found the solution here: https://stackoverflow.com/questions/77331852/how-do-i-set-a-home-page-can-be-opened-by-anyone-in-spring-security

The problem is that my application file is not placed at the root package.

marcusdacoregio · 2023-10-27T15:52:46Z

Hi, @dv0892. Your configuration should look like this:

@Bean
public SecurityFilterChain filterChain( HttpSecurity http , MvcRequestMatcher.Builder mvc) throws Exception {
	http.csrf(AbstractHttpConfigurer::disable)
	.authorizeHttpRequests(auth ->
		auth
				.dispatcherTypeMatchers(DispatcherType.FORWARD).permitAll()
				.requestMatchers(mvc.pattern("/"), mvc.pattern("/welcome")).permitAll()
				.anyRequest().authenticated()
		)
	.formLogin(Customizer.withDefaults())
	.httpBasic(Customizer.withDefaults());

	return http.build();
}

@Scope("prototype")
@Bean
MvcRequestMatcher.Builder mvc(HandlerMappingIntrospector introspector) {
	return new MvcRequestMatcher.Builder(introspector);
}

Note that I removed the servletPath("/") from the MvcRequestMatcher.Builder bean since you want to match the default servlet instead of one mapped under /. It seems a bit weird because the error message when not using the MVC request matcher says:

This is because there is more than one mappable servlet in your servlet context: {org.apache.jasper.servlet.JspServlet=[*.jspx, *.jsp], org.springframework.web.servlet.DispatcherServlet=[/]}.

In 6.2, that behavior has been fixed by #13850 where you can use .requestMatchers("/", "/welcome"). I'll check with @jzheaux whether that issue should be back-ported.

Then, you must allow DispatcherType.FORWARD because Spring MVC will forward the request to /WEB-INF/views/welcome.jsp.

I'll close this since this is a configuration issue and not a bug, however I'll keep this updated if we can somehow improve the misleading error message.

marcusdacoregio · 2023-11-16T11:58:36Z

#13850 has been backported via #14078

PavelBortnovskyi · 2024-03-06T17:11:16Z

I am facing the same issue. Cannot access any of permitAll endpoints. My Security configuration:

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity httpSec) throws Exception {

                httpSec.csrf(AbstractHttpConfigurer::disable)
                .authorizeHttpRequests(auth -> auth
                        .dispatcherTypeMatchers(DispatcherType.FORWARD).permitAll()
                        .requestMatchers("/api/v1/auth/login").permitAll()
                        .requestMatchers("/api/v1/auth/register").permitAll()
                        .requestMatchers("/swagger-ui/**").permitAll()
                        .requestMatchers("/swagger-resources/**").permitAll()
                        .requestMatchers("/webjars/**").permitAll()
                        .requestMatchers("/v2/api-docs").permitAll()
                        .anyRequest().authenticated())
                        .httpBasic(Customizer.withDefaults())
                        .sessionManagement(httpSecuritySessionManagementConfigurer ->
                                httpSecuritySessionManagementConfigurer.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

        //JWT token authentication
        httpSec.addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);

        //Filter for interception of JwtAuthenticationException from jwtAuthFilter
        httpSec.addFilterBefore(filterExceptionHandler, JwtAuthFilter.class);

        return httpSec.build();
    }

TRACE log:

2024-03-06T17:07:06.378Z DEBUG 15416 --- [nio-8080-exec-2] s.w.a.DelegatingAuthenticationEntryPoint 2024-03-06T17:07:06.378Z DEBUG 15416 --- [nio-8080-exec-2] s.w.a.DelegatingAuthenticationEntryPoint 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z DEBUG 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.s.w.a.logout.LogoutFilter 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.s.w.a.www.BasicAuthenticationFilter 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] .s.s.w.c.SupplierDeferredSecurityContext 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.s.w.a.AnonymousAuthenticationFilter 2024-03-06T17:07:37.899Z DEBUG 15416 --- [nio-8080-exec-1] o.s.s.w.session.SessionManagementFilter 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] estMatcherDelegatingAuthorizationManager 2024-03-06T17:07:37.899Z TRACE 15416 --- [nio-8080-exec-1] estMatcherDelegatingAuthorizationManager 2024-03-06T17:07:37.899Z DEBUG 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.s.w.header.writers.HstsHeaderWriter 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z DEBUG 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.s.w.a.logout.LogoutFilter 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.security.web.FilterChainProxy 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] estMatcherDelegatingAuthorizationManager 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] estMatcherDelegatingAuthorizationManager 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] .s.s.w.c.SupplierDeferredSecurityContext 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.s.w.a.AnonymousAuthenticationFilter 2024-03-06T17:07:37.901Z TRACE 15416 --- [nio-8080-exec-1] o.s.s.w.a.ExceptionTranslationFilter : Trying to match using RequestHeaderRequestMatcher [expectedHeaderName=X-Requested-With, expectedHeaderValue=XMLHttpRequest]
: No match found. Using default entry point org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint@5251a246
: Trying to match request against DefaultSecurityFilterChain [RequestMatcher=any request, Filters=[org.springframework.security.web.session.DisableEncodeUrlFilter@d4e88cd, org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@401b7d95, org.springframework.security.web.context.SecurityContextHolderFilter@599521a8, org.springframework.security.web.header.HeaderWriterFilter@20ff6d2e, org.springframework.web.filter.CorsFilter@2529c7be, org.springframework.security.web.authentication.logout.LogoutFilter@6ec592dd, com.neo.mongocachetest.exceptions.FilterExceptionHandler@17abfbb, com.neo.mongocachetest.security.JwtAuthFilter@19ebd88c, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@6d81cf40, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@21db3fcc, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@44610383, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@1de42d5b, org.springframework.security.web.session.SessionManagementFilter@3704cf67, org.springframework.security.web.access.ExceptionTranslationFilter@3337da04, org.springframework.security.web.access.intercept.AuthorizationFilter@243c9e9e]] (1/1)
: Securing GET /swagger-ui/index.html
: Invoking DisableEncodeUrlFilter (1/15)
: Invoking WebAsyncManagerIntegrationFilter (2/15)
: Invoking SecurityContextHolderFilter (3/15)
: Invoking HeaderWriterFilter (4/15)
: Invoking CorsFilter (5/15)
: Invoking LogoutFilter (6/15)
: Did not match request to Or [Ant [pattern='/logout', GET], Ant [pattern='/logout', POST], Ant [pattern='/logout', PUT], Ant [pattern='/logout', DELETE]]
: Invoking FilterExceptionHandler (7/15)
: Invoking JwtAuthFilter (8/15)
: Invoking BasicAuthenticationFilter (9/15)
: Did not process authentication request since failed to find username and password in Basic Authorization header
: Invoking RequestCacheAwareFilter (10/15)
: Invoking SecurityContextHolderAwareRequestFilter (11/15)
: Invoking AnonymousAuthenticationFilter (12/15)
: Invoking SessionManagementFilter (13/15)
: Created SecurityContextImpl [Null authentication]
: Set SecurityContextHolder to AnonymousAuthenticationToken [Principal=anonymousUser, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=127.0.0.1, SessionId=null], Granted Authorities=[ROLE_ANONYMOUS]]
: Request requested invalid session id ECB3065A5FFBD200FF920E6C0A1B8DCD
: Invoking ExceptionTranslationFilter (14/15)
: Invoking AuthorizationFilter (15/15)
: Authorizing SecurityContextHolderAwareRequestWrapper[ org.springframework.security.web.header.HeaderWriterFilter$HeaderWriterRequest@41209d0e]
: Checking authorization on SecurityContextHolderAwareRequestWrapper[ org.springframework.security.web.header.HeaderWriterFilter$HeaderWriterRequest@41209d0e] using org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer$$Lambda/0x000001a81465bb40@427f9bc8
: Secured GET /swagger-ui/index.html
: Not injecting HSTS header since it did not match request to [Is Secure]
: Trying to match request against DefaultSecurityFilterChain [RequestMatcher=any request, Filters=[org.springframework.security.web.session.DisableEncodeUrlFilter@d4e88cd, org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@401b7d95, org.springframework.security.web.context.SecurityContextHolderFilter@599521a8, org.springframework.security.web.header.HeaderWriterFilter@20ff6d2e, org.springframework.web.filter.CorsFilter@2529c7be, org.springframework.security.web.authentication.logout.LogoutFilter@6ec592dd, com.neo.mongocachetest.exceptions.FilterExceptionHandler@17abfbb, com.neo.mongocachetest.security.JwtAuthFilter@19ebd88c, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@6d81cf40, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@21db3fcc, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@44610383, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@1de42d5b, org.springframework.security.web.session.SessionManagementFilter@3704cf67, org.springframework.security.web.access.ExceptionTranslationFilter@3337da04, org.springframework.security.web.access.intercept.AuthorizationFilter@243c9e9e]] (1/1)
: Securing GET /error
: Invoking DisableEncodeUrlFilter (1/15)
: Invoking WebAsyncManagerIntegrationFilter (2/15)
: Invoking SecurityContextHolderFilter (3/15)
: Invoking HeaderWriterFilter (4/15)
: Invoking CorsFilter (5/15)
: Invoking LogoutFilter (6/15)
: Did not match request to Or [Ant [pattern='/logout', GET], Ant [pattern='/logout', POST], Ant [pattern='/logout', PUT], Ant [pattern='/logout', DELETE]]
: Invoking FilterExceptionHandler (7/15)
: Invoking JwtAuthFilter (8/15)
: Invoking BasicAuthenticationFilter (9/15)
: Invoking RequestCacheAwareFilter (10/15)
: Invoking SecurityContextHolderAwareRequestFilter (11/15)
: Invoking AnonymousAuthenticationFilter (12/15)
: Invoking SessionManagementFilter (13/15)
: Invoking ExceptionTranslationFilter (14/15)
: Invoking AuthorizationFilter (15/15)
: Authorizing SecurityContextHolderAwareRequestWrapper[ FirewalledRequest[ org.apache.catalina.core.ApplicationHttpRequest@45b80f8a]]
: Checking authorization on SecurityContextHolderAwareRequestWrapper[ FirewalledRequest[ org.apache.catalina.core.ApplicationHttpRequest@45b80f8a]] using org.springframework.security.authorization.AuthenticatedAuthorizationManager@38b96bce
: Created SecurityContextImpl [Null authentication]
: Set SecurityContextHolder to AnonymousAuthenticationToken [Principal=anonymousUser, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=127.0.0.1, SessionId=null], Granted Authorities=[ROLE_ANONYMOUS]]
: Sending AnonymousAuthenticationToken [Principal=anonymousUser, Credentials=[PROTECTED], Authenticated=true, Details=WebAuthenticationDetails [RemoteIpAddress=127.0.0.1, SessionId=null], Granted Authorities=[ROLE_ANONYMOUS]] to authentication entry point since access is denied

org.springframework.security.access.AccessDeniedException: Access Denied
at org.springframework.security.web.access.intercept.AuthorizationFilter.doFilter(AuthorizationFilter.java:98) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:126) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:120) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:91) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:85) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:100) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:179) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:101) ~[spring-web-6.1.4.jar:6.1.4]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:101) ~[spring-web-6.1.4.jar:6.1.4]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:101) ~[spring-web-6.1.4.jar:6.1.4]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:107) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:93) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:101) ~[spring-web-6.1.4.jar:6.1.4]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:101) ~[spring-web-6.1.4.jar:6.1.4]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.context.SecurityContextHolderFilter.doFilter(SecurityContextHolderFilter.java:82) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.context.SecurityContextHolderFilter.doFilter(SecurityContextHolderFilter.java:69) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:101) ~[spring-web-6.1.4.jar:6.1.4]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:101) ~[spring-web-6.1.4.jar:6.1.4]
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:374) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:233) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:191) ~[spring-security-web-6.2.2.jar:6.2.2]
at org.springframework.web.filter.CompositeFilter$VirtualFilterChain.doFilter(CompositeFilter.java:113) ~[spring-web-6.1.4.jar:6.1.4]
at org.springframework.web.servlet.handler.HandlerMappingIntrospector.lambda$createCacheFilter$3(HandlerMappingIntrospector.java:195) ~[spring-webmvc-6.1.4.jar:6.1.4]
at org.springframework.web.filter.CompositeFilter$VirtualFilterChain.doFilter(CompositeFilter.java:113) ~[spring-web-6.1.4.jar:6.1.4]
at org.springframework.web.filter.CompositeFilter.doFilter(CompositeFilter.java:74) ~[spring-web-6.1.4.jar:6.1.4]
at org.springframework.security.config.annotation.web.configuration.WebMvcSecurityConfiguration$CompositeFilterChainProxy.doFilter(WebMvcSecurityConfiguration.java:230) ~[spring-security-config-6.2.2.jar:6.2.2]
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:352) ~[spring-web-6.1.4.jar:6.1.4]
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:268) ~[spring-web-6.1.4.jar:6.1.4]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:101) ~[spring-web-6.1.4.jar:6.1.4]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:642) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:410) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:340) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:277) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.catalina.core.StandardHostValve.custom(StandardHostValve.java:362) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.catalina.core.StandardHostValve.status(StandardHostValve.java:222) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:151) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:391) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:896) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1744) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63) ~[tomcat-embed-core-10.1.19.jar:10.1.19]
at java.base/java.lang.Thread.run(Thread.java:1583) ~[na:na]

drakgoku · 2024-07-23T16:04:30Z

I have the same problem. There is a specific type of configuration that causes the error to occur.
This is like searching for a pin in a field of straw.
I would ask you to reopen the thread.

Although if it remains closed it is less work to do. This option sounds better.

By the way, with error 999. Like looking for a pin.

baiglin · 2024-08-07T12:44:14Z

@drakgoku Maybe check responses in #10587

Vishal-Bala907 · 2024-09-27T07:59:33Z

I got the same problem with this code
security.authorizeHttpRequests((req) -> req.requestMatchers("/").permitAll() .requestMatchers("/user/**").hasAnyRole("ADMIN", "USER").anyRequest().authenticated()) .csrf(csrf -> csrf.disable()).formLogin(Customizer.withDefaults()); return security.build();

then i just added the

.dispatcherTypeMatchers(DispatcherType.FORWARD, DispatcherType.ERROR).permitAll()
line, and after that my problem was solved.

security.authorizeHttpRequests((req) -> req.requestMatchers("/").permitAll() .dispatcherTypeMatchers(DispatcherType.FORWARD, DispatcherType.ERROR).permitAll() .requestMatchers("/user/").hasAnyRole("ADMIN", "USER").anyRequest().authenticated()) .csrf(csrf -> csrf.disable()).formLogin(Customizer.withDefaults());

Another solution is, add the spring security dependency when you are creating the project not after creating the project

dv0892 added status: waiting-for-triage An issue we've not yet triaged type: bug A general bug labels Oct 13, 2023

marcusdacoregio added the status: waiting-for-feedback We need additional information before we can continue label Oct 16, 2023

spring-projects-issues added status: feedback-provided Feedback has been provided and removed status: waiting-for-feedback We need additional information before we can continue labels Oct 17, 2023

marcusdacoregio added status: waiting-for-feedback We need additional information before we can continue and removed status: waiting-for-triage An issue we've not yet triaged status: feedback-provided Feedback has been provided labels Oct 17, 2023

spring-projects-issues added status: feedback-provided Feedback has been provided and removed status: waiting-for-feedback We need additional information before we can continue labels Oct 17, 2023

marcusdacoregio self-assigned this Oct 23, 2023

marcusdacoregio added in: config An issue in spring-security-config and removed status: feedback-provided Feedback has been provided labels Oct 23, 2023

marcusdacoregio added this to Spring Security Team Oct 23, 2023

marcusdacoregio closed this as completed Oct 27, 2023

marcusdacoregio added the status: invalid An issue that we don't feel is valid label Oct 27, 2023

fanciz1227 mentioned this issue May 4, 2024

Spring Security 6.2.4 Configuraion Issue : Permit All Not working (jsp mvc controller) #15008

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Spring Security Configuraion Issue : Permit All Not working #14011

Spring Security Configuraion Issue : Permit All Not working #14011

dv0892 commented Oct 13, 2023 •

edited by marcusdacoregio

Loading

chipbk10 commented Oct 14, 2023

marcusdacoregio commented Oct 16, 2023

chipbk10 commented Oct 17, 2023

marcusdacoregio commented Oct 17, 2023

chipbk10 commented Oct 17, 2023

chipbk10 commented Oct 20, 2023

xtyuns commented Oct 22, 2023

chipbk10 commented Oct 22, 2023

marcusdacoregio commented Oct 27, 2023 •

edited

Loading

marcusdacoregio commented Nov 16, 2023

PavelBortnovskyi commented Mar 6, 2024 •

edited

Loading

drakgoku commented Jul 23, 2024 •

edited

Loading

baiglin commented Aug 7, 2024 •

edited

Loading

Vishal-Bala907 commented Sep 27, 2024

Spring Security Configuraion Issue : Permit All Not working #14011

Spring Security Configuraion Issue : Permit All Not working #14011

Comments

dv0892 commented Oct 13, 2023 • edited by marcusdacoregio Loading

chipbk10 commented Oct 14, 2023

marcusdacoregio commented Oct 16, 2023

chipbk10 commented Oct 17, 2023

marcusdacoregio commented Oct 17, 2023

chipbk10 commented Oct 17, 2023

chipbk10 commented Oct 20, 2023

xtyuns commented Oct 22, 2023

chipbk10 commented Oct 22, 2023

marcusdacoregio commented Oct 27, 2023 • edited Loading

marcusdacoregio commented Nov 16, 2023

PavelBortnovskyi commented Mar 6, 2024 • edited Loading

drakgoku commented Jul 23, 2024 • edited Loading

baiglin commented Aug 7, 2024 • edited Loading

Vishal-Bala907 commented Sep 27, 2024

dv0892 commented Oct 13, 2023 •

edited by marcusdacoregio

Loading

marcusdacoregio commented Oct 27, 2023 •

edited

Loading

PavelBortnovskyi commented Mar 6, 2024 •

edited

Loading

drakgoku commented Jul 23, 2024 •

edited

Loading

baiglin commented Aug 7, 2024 •

edited

Loading