asmhatre
4a8dab6739
Runnable companion for https://ankurm.com/spring-security-7-1-jwt-authentication-guide/ - login -> token issue -> OncePerRequestFilter -> SecurityContext, end to end - HS256 and RS256 variants (RS256 publishes a real JWKS endpoint) - the same API secured by the built-in oauth2ResourceServer().jwt(), for comparison - 11 documentation chapters under docs/, interlinked with the code - docs/output/ is real captured output, regenerated by scripts/run-all.sh - 13 passing tests pinning the 401-vs-403 contract and the CSRF failure Verified against Spring Boot 4.1.1, Spring Security 7.1.1, JDK 25.0.4.1.
55 lines
2.1 KiB
Plaintext
55 lines
2.1 KiB
Plaintext
==========================================================================
|
|
jwt-auth-demo - CSRF vs permitAll()
|
|
app started with: --spring.profiles.active=hs256,csrfon
|
|
==========================================================================
|
|
|
|
--------------------------------------------------------------------------
|
|
# A. The login endpoint is permitAll(). POST it anyway.
|
|
# 403 - and nothing in the authorization rules explains why.
|
|
|
|
HTTP 403
|
|
WWW-Authenticate: Bearer
|
|
|
|
--------------------------------------------------------------------------
|
|
# B. GET on the same permitAll() path family works. Only unsafe methods break.
|
|
|
|
HTTP 200
|
|
Content-Type: application/json
|
|
{
|
|
"authenticationRequired": false,
|
|
"status": "up"
|
|
}
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
# C. The filter chain, with CsrfFilter present. Count the positions:
|
|
# CsrfFilter is 5th, AuthorizationFilter is last. The request never
|
|
# reaches the filter that knows about permitAll().
|
|
|
|
HTTP 200
|
|
Content-Type: application/json
|
|
[
|
|
{
|
|
"matchesThisRequest": true,
|
|
"filters": [
|
|
"DisableEncodeUrlFilter",
|
|
"WebAsyncManagerIntegrationFilter",
|
|
"SecurityContextHolderFilter",
|
|
"HeaderWriterFilter",
|
|
"CsrfFilter",
|
|
"JwtAuthenticationFilter",
|
|
"RequestCacheAwareFilter",
|
|
"SecurityContextHolderAwareRequestFilter",
|
|
"AnonymousAuthenticationFilter",
|
|
"SessionManagementFilter",
|
|
"ExceptionTranslationFilter",
|
|
"AuthorizationFilter"
|
|
],
|
|
"chain": "DefaultSecurityFilterChain defined as 'apiFilterChain' in [class path resource [com/ankurm/jwtauth/config/SecurityConfig.class]] matching [any request] and having filters [DisableEncodeUrl, WebAsyncManagerIntegration, SecurityContextHolder, HeaderWriter, Csrf, JwtAuthentication, RequestCacheAware, SecurityContextHolderAwareRequest, AnonymousAuthentication, SessionManagement, ExceptionTranslation, Authorization]"
|
|
}
|
|
]
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
# end
|