Why does spring security ignore http configuration?

358 Views Asked by At

I have a problem in the SecurityFilterChain configuration for multiple http requests, the "CLIENT" configuration works, I don't need a redirect to a dedicated login, but the authentication is according to my requirements. The problem lies in the Admin configuration, which completely ignores it, does not redirect to the declared login and does not set any restrictions. It should be noted that this problem only happens in the Railway.app hosting, where I want to migrate the project, this project was deployed on heroku and localhost but there was no such problem.

This is the admin configuration class

@Configuration
@Order(1)
public class adminSecurityConfig {

    @Bean
    public UserDetailsService userDetailsService() {
        return new CustomUserDetailsService();
    }

    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public SecurityFilterChain filterChain1(HttpSecurity http) throws Exception {
        //http.authorizeRequests().antMatchers("/").permitAll();

        http // ...
                .csrf().disable();

        http.antMatcher("/dashboard/**")
                .authorizeHttpRequests(authorize -> authorize
                .anyRequest().hasRole("ADMIN")
            )
                .formLogin()
                .loginPage("/dashboard/login_admin")
                .usernameParameter("email")
                .loginProcessingUrl("/dashboard/login_admin")
                .defaultSuccessUrl("/dashboard/home")
                .and()
                .logout()
                .logoutUrl("/dashboard/logout")
                .logoutSuccessUrl("/")
                .and()
                .exceptionHandling().accessDeniedPage("/403");
        System.out.println("Configuracion de Admin");
        return http.build();
    }
    
}

This is the configuration class 'client'

@Configuration
@Order(2)
public class clienteSecurityConfig {
    /*
    @Bean
    public AuthenticationSuccessHandler successHandler() {
        SimpleUrlAuthenticationSuccessHandler handler = new SimpleUrlAuthenticationSuccessHandler();
        handler.setUseReferer(true);
        return handler;
    }*/
    
    @Autowired
    AuthFailuredHandler authFailureHandler;
    
    @Autowired
    AuthSuccesHandler authAuthSuccesHandle;
  
    @Bean
    public SecurityFilterChain filterChain2(HttpSecurity http) throws Exception {

         http 
                .csrf().disable();
        
        http
                .requestCache().disable().authorizeRequests()
                .antMatchers("/detalle-pago","/validarCupon","/pago2","/pagar")
                .hasAuthority("CLIENTE")
                //
            .and()
            
            .formLogin()
            .usernameParameter("email")
            .passwordParameter("password")
            .loginProcessingUrl("/login_cliente")
            .successHandler(authAuthSuccesHandle)
            .failureHandler(authFailureHandler)
            .permitAll()
            .and()
            .logout()
            .logoutUrl("/logout")
            .logoutSuccessUrl("/")
                .and()
                .exceptionHandling().accessDeniedPage("/403");
        System.out.println("Configuracion de Cliente");
        return http.build();
    }
}

As you can see, it has a different @Order annotation with priority for the Admin. In theory the client should not Override the admin, and in fact it should not happen because on localhost and on heroku they work perfectly. Please, if someone could help me find the error, it would be very helpful. Thanks in advance

0

There are 0 best solutions below