Use the same URL to login and retrieve data

Question

I'm implementing Spring Security on API-REST, of we are developing. My product manager told us to use the same url to return data and to login. This url, as a POST, and that wait a JSON. I can't configure the environment for do that, is possible? or always we need have a different url to login?

Thank you!!

This is the JSON on JAVA

@Getter
@Setter
public class CheckCloudUsersJSON implements Serializable {

    private String tvAdmin;
    private String ip;
}

    @PostMapping(value = "/check-cloudusers", produces = MediaType.APPLICATION_JSON_VALUE)
    public ResponseEntity checkCloudUsers(@RequestBody CheckCloudUsersJSON checkCloudUsersJSON) {


@EnableWebSecurity
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {

        JWTAuthenticationFilter authenticationFilter = new JWTAuthenticationFilter(authenticationManager());
        authenticationFilter.setFilterProcessesUrl("/mobile/login");

        httpSecurity
                .cors().and()
                .csrf().disable()
                .authorizeRequests()
                .antMatchers(HttpMethod.GET, VERSION_URL).permitAll()
                .anyRequest().authenticated()
                .and()
                .addFilter(new JWTAuthenticationFilter(authenticationManager()))
                .addFilter(new JWTAuthorizationFilter(authenticationManager()))
                .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }

    @Bean
    CorsConfigurationSource corsConfigurationSource() {
        final UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
        return source;
    }
}


public class JWTAuthenticationFilter extends UsernamePasswordAuthenticationFilter {

    private AuthenticationManager authenticationManager;

    public JWTAuthenticationFilter(AuthenticationManager authenticationManager) {
        this.authenticationManager = authenticationManager;

        setFilterProcessesUrl(AUTH_LOGIN_URL);
    }

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
            throws AuthenticationException {
        try {
            TVUser credenciales = new ObjectMapper().readValue(request.getInputStream(), TVUser.class);

            return new UsernamePasswordAuthenticationToken(
                    credenciales.getTvUserId(), null);
        } catch (IOException e) {
            throw new RuntimeException(e);
        }
    }

    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain,
                                            Authentication auth) throws IOException, ServletException {
        String userName = auth.getPrincipal().toString();

        byte[] signingKey = SECRET_KEY.getBytes();

        String token = Jwts.builder()
                .signWith(Keys.hmacShaKeyFor(signingKey), SignatureAlgorithm.HS512)
                .setHeaderParam("typ", TOKEN_TYPE)
                .setIssuer(TOKEN_ISSUER)
                .setAudience(TOKEN_AUDIENCE)
                .setSubject(userName)
                .setExpiration(new Date(System.currentTimeMillis() + 900000))
                .compact();
        response.addHeader(TOKEN_HEADER, TOKEN_PREFIX + token);
    }
}

Where does the user and password go to the authentication? In the JSON checkCloudUsers JSON? And the endpoint will return a 200 Ok Code and the JWT Token in the authorization header.

score 1 · Answer 1 · answered Aug 14 '19 at 09:30

Please elaborate from what you are trying to do, but anyways from what i understand ,since you are using spring security we need to authorise the login request and return the JSON response from the login webservice as a part of the response body.

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    http
    .authorizeRequests()
    .antMatchers("/login/**").permitAll()
    .anyRequest().authenticated(); 
}

@PostMapping("/login")
public JsonResponse login() {

    // Point to the login page
    // Return the json in the response with a 200 OK
}

Use the same URL to login and retrieve data

1 Answers1