i am facing issue with implementation of basic authentication spring security for spring boot 3 in java 17 i am having x-auth token as old and now i was also implementing this basic auth but unfortunately basic auth is calling authenticate method of x-auth-token which creates prob and gives me class casting error if we comment out or remove x-auth token implementation then basic auth works charm but yet my target is to implement multiple security basic auth with xauth independently
i tried combining them in 1 file using an inner class and also providing Order annotation which will make preference to basic auth also i tried them in 2 different files but still basic auth .authenticated calls authenticate method of xauth token please help me out oif any solution provided code
Only basic auth
@Configuration
@EnableMethodSecurity
public class SecurityConfig {
// User Creation
// Configuring HttpSecurity
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.requestMatchers(new AntPathRequestMatcher("/index")).permitAll()
.requestMatchers("/api/**").authenticated()
.and().httpBasic();
return http.build();
}
@Bean
public UserDetailsService userDetailsService(PasswordEncoder encoder) {
// InMemoryUserDetailsManager
UserDetails user = User.withUsername("123")
.password(encoder.encode("123"))
.roles("USER")
.build();
return new InMemoryUserDetailsManager(user);
}
// Password Encoding
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
}
combining basic auth + x auth
@Configuration
@Order(1)
public class BasicAuthSecurityConfig {
@Bean
public SecurityFilterChain basicAuthFilterChain(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.requestMatchers(new AntPathRequestMatcher("/index"))
.permitAll()
.requestMatchers(new AntPathRequestMatcher("/api/user/**")).authenticated()
.and().httpBasic();
return http.build();
}
}
@Configuration
@Order(2)
public class XAuthSecurityConfig {
@Bean
public SecurityFilterChain xAuthFilterChain(HttpSecurity http) throws Exception {
http.csrf().disable()
.authorizeRequests()
.requestMatchers(new AntPathRequestMatcher("/index")).permitAll()
.requestMatchers(new AntPathRequestMatcher("/api/give/")).authenticated()
.and()
.addFilterBefore(AuthenticationFilter(), BasicAuthenticationFilter.class)
.addFilterBefore(webSecurityCorsFilter(), ChannelProcessingFilter.class)
.exceptionHandling().authenticationEntryPoint(AuthenticationEntryPoint())
.and().requestCache().requestCache(httpSessionRequestCache())
.and().anonymous().disable()
.headers().frameOptions().disable();
return http.build();
}
}
in both cases basic authentication is calling authenticate method of xauth-token which should be the case if i remove or comment out code of xauthtoken basic auth works please provide me some info that how can i combine both and not interacting with each other also as spring boot 3 and java 17 what the latest syntax used for it and correct my above code if anything not correct
thanks