i am facing issue with implementation of basic authentication spring security for spring boot 3 in java 17 i am having x-auth token as old and now i was also implementing this basic auth but unfortunately basic auth is calling authenticate method of x-auth-token which creates prob and gives me class casting error if we comment out or remove x-auth token implementation then basic auth works charm but yet my target is to implement multiple security basic auth with xauth independently

i tried combining them in 1 file using an inner class and also providing Order annotation which will make preference to basic auth also i tried them in 2 different files but still basic auth .authenticated calls authenticate method of xauth token please help me out oif any solution provided code

Only basic auth

@Configuration
@EnableMethodSecurity
public class SecurityConfig {
    // User Creation
    // Configuring HttpSecurity
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
         http.csrf().disable()
            .authorizeRequests()
            .requestMatchers(new AntPathRequestMatcher("/index")).permitAll()
            .requestMatchers("/api/**").authenticated()
            .and().httpBasic();
         return http.build();
    }
    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder encoder) {
        // InMemoryUserDetailsManager
        UserDetails user = User.withUsername("123")
            .password(encoder.encode("123"))
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
    // Password Encoding
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

combining basic auth + x auth

    @Configuration
    @Order(1)
    public class BasicAuthSecurityConfig {
        @Bean
        public SecurityFilterChain basicAuthFilterChain(HttpSecurity http) throws Exception {
            http.csrf().disable()
                .authorizeRequests()
                .requestMatchers(new AntPathRequestMatcher("/index"))
                .permitAll()
                .requestMatchers(new AntPathRequestMatcher("/api/user/**")).authenticated()
                .and().httpBasic();
            return http.build();
        }
    }
    @Configuration
    @Order(2)
    public class XAuthSecurityConfig {
        @Bean
        public SecurityFilterChain xAuthFilterChain(HttpSecurity http) throws Exception {
            http.csrf().disable()
                .authorizeRequests()
                .requestMatchers(new AntPathRequestMatcher("/index")).permitAll()
                .requestMatchers(new AntPathRequestMatcher("/api/give/")).authenticated()
                .and()
                .addFilterBefore(AuthenticationFilter(), BasicAuthenticationFilter.class)
                .addFilterBefore(webSecurityCorsFilter(), ChannelProcessingFilter.class)
                .exceptionHandling().authenticationEntryPoint(AuthenticationEntryPoint())
                .and().requestCache().requestCache(httpSessionRequestCache())
                .and().anonymous().disable()
                .headers().frameOptions().disable();
            return http.build();
        }
    }

in both cases basic authentication is calling authenticate method of xauth-token which should be the case if i remove or comment out code of xauthtoken basic auth works please provide me some info that how can i combine both and not interacting with each other also as spring boot 3 and java 17 what the latest syntax used for it and correct my above code if anything not correct

thanks

0

There are 0 best solutions below