Skip to main content
29,158 questions
Newest Active Bountied Unanswered
Filter by
Sorted by
Tagged with
0 votes
0 answers
7 views

I'm testing my Spring servlet application for an AP-initiated SLO, and I get a 500 error from the Asserting party when I return a success message in SamlLogoutResponse. The AP logs indicate that the ...
Kartik's user avatar
  • 83
Advice
0 votes
1 replies
25 views

How to implement Auth0 Universal Login + Silent SSO + SLO in a legacy Spring MVC (SSR) app? Can the Auth0 SPA SDK be used? I have a legacy Spring MVC (server-side rendered) application using: Spring ...
Abhishek Singh's user avatar
  • 625
0 votes
0 answers
54 views

I have this Spring Security configuration for Spring cloud 2025.0.0: import org.springframework.security.web.util.matcher.AntPathRequestMatcher; private RequestMatcher[] permittedAntMatchers() { ...
Peter Penzov's user avatar
  • 1,102
1 vote
0 answers
70 views

I tried to upgrade my codes to Spring Boot 4.0.0, and given the following Kotlin codes, @Bean fun auditorAware(): ReactiveAuditorAware<String> = ReactiveAuditorAware<String> { ...
Hantsy's user avatar
  • 9,609
0 votes
1 answer
70 views

I am learning Spring Authorization Server and trying to build a simple OAuth2 Authorization Server without OpenID Connect. i want to handle the login page myself inside the same Authorization Server ...
Praveen kumar's user avatar
  • 122
0 votes
0 answers
56 views

I have an unclear situation. I'm using a controller with any endpoints. I have a two methods with Get endpoints /short and /{idOrCode}. Pathvariable is a String type. Endpoint with this pathvariable ...
ivvasch's user avatar
  • 71
1 vote
0 answers
62 views

I have got a (Thymeleaf) form which I have made accessible to all users, even to those who are not logged in, in order to improve the UX. Only submitting the form (through a POST request) requires ...
Gustav Blaß's user avatar
  • 11
0 votes
0 answers
57 views

I'm a beginner working on a team project and currently creating a "board" page in React + Spring Boot. I'm really confused because I keep getting a 401 Unauthorized error when submitting a ...
유연준's user avatar
  • 1
Best practices
0 votes
2 replies
46 views

I have a REST API server application that authenticates users exclusively via X.509 authentication implemented with Spring Security, using the Common Name (CN) from the client certificate directly as ...
Hailong Liu's user avatar
  • 15
0 votes
0 answers
27 views

I have written my Spring Boot security configuration like this: @Bean public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception { DefaultBearerTokenResolver ...
hell_storm2004's user avatar
  • 1,663
1 vote
1 answer
106 views

I'm running keycloak, next js, and spring boot app using docker compose. Right now I'm having issue in setting up network configurations, usually either I'm getting issuer mismatch in the backend, or ...
Vimal Kumar's user avatar
  • 13
1 vote
1 answer
88 views

I am applying Spring Security in a Spring MVC (Spring Boot) application. The application already has CSRF and Session Management and I want to apply JWT Authentication along with Spring security. But ...
Phoenix's user avatar
  • 133
Best practices
4 votes
2 replies
120 views

I’ve been working on an issue in our Spring Boot application for some time now: authorization. Because we have a more complex permission model — permissions depend not only on roles, but also on user-...
0xRelu's user avatar
  • 25
0 votes
1 answer
87 views

Has anyone been able to change the default success URL after login in Vaadin 24, where we are supposed to handle the filter as follows: public SecurityFilterChain securityFilterChain(@NonNull ...
Jennifer's user avatar
  • 105
0 votes
0 answers
44 views

Below is my code block. I want to run my public API without JWT authorization. Even if I am using the security filter chain having been set to permit all public, I am still getting the issue of an ...
sunny vishwakarma's user avatar
  • 21
Advice
1 vote
1 replies
44 views

I am aware that some identity providers (IDPs) may not return all requested attributes but I would like to have them published in my service provider (SP) SAML metadata to encourage any IDP who does ...
Andrew's user avatar
  • 3
1 vote
0 answers
58 views

I'd like to add Passkey (WebAuthn) support to an application. As I want to have a custom designed login and registration page, I disable the default registration page and configure a custom login page....
Oliver's user avatar
  • 41
-1 votes
2 answers
90 views

I am following a tutorial with Spring Boot and I am stuck in the authentication phase. I have a JwtRequestFilter.java Security Filter Class which is implemented in SecurityConfig.java just before ...
Nay Aung Lin's user avatar
  • 125
0 votes
1 answer
87 views

I’m developing a Spring Boot application deployed behind an AWS API Gateway (HTTP API v2) with Lambda (handler based on SpringBootLambdaContainerHandler and HttpApiV2ProxyRequest). I’m using OAuth2 ...
nekatte's user avatar
  • 11
0 votes
0 answers
58 views

I have an older version of my app that I upgraded to SpringBoot 3.5.x and the SAML ACS URL changed after upgrading. So I used urlrewrite to forward the request from the old URL to the new URL. ...
chubbsondubs's user avatar
  • 39.4k
1 vote
0 answers
64 views

I'm struggeling with an Spring Boot Update of my service, from Spring Boot 2.7 to 3.2. This update includes an update of Spring Security 5.7 to 6.1. The class WebSecurityConfigurerAdapter is no longer ...
SWYM's user avatar
  • 53
1 vote
1 answer
101 views

I’m testing a POST endpoint of a stateless API (no sessions/forms) and Postman returns 403 Forbidden. I suspect CSRF, but I’m not sure how to configure it correctly in Security 6 for a stateless REST ...
Dayana Escobar's user avatar
  • 31
1 vote
1 answer
94 views

I follow the book Pro Spring Security 6 and try to make a simple OAuth 2 authentication. My configuration: @Configuration @EnableWebSecurity public class SpringSecurityConfiguration { @Bean ...
Arkadi's user avatar
  • 45
0 votes
0 answers
27 views

How to have post_logout_redirect_uri when we have spring-cloud-gateway which is served for multiple frontend applications and each of those applications could have it's own logout page? Is it just ok ...
bilak's user avatar
  • 5,056
0 votes
0 answers
116 views

I recently upgraded Java, Springboot, Sprint Security, and Tomcat to versions 21, 3.5.6, 6.5.5, and 10, respectively, from versions 8, 2.7.5, 5.3.23, and 9, respectively, and I am updating my security ...
Patrick Hughes's user avatar
  • 9
1 vote
2 answers
68 views

Context I have a Spring Boot REST API acting as an OAuth2 Resource Server, configured with Spring Security 6. Salesforce is my external authorization server (IdP). The access token issued by ...
Kevin RAMAROZATOVO's user avatar
  • 13
2 votes
0 answers
54 views

I have an application written in Grails 6.x. I use spring-security-core and spring-security-ldap plugins to authenticate against an Active Directory server. I have set a timeout of 5 minutes, and once ...
NiBE's user avatar
  • 955
0 votes
0 answers
40 views

I am trying to get the authenticated user ID. I want to access the user ID in the global layout. templates/layout.html: <li sec:authorize="isAuthenticated()" class="nav-item btn btn-...
IgorArnaut's user avatar
  • 62
0 votes
1 answer
88 views

The intent of the Spring Boot application I'm building is to have a login against an IDP (Spring Security OAuth2 Login). For access to several third party APIs (Spring Security OAuth2 Client) I will ...
Magnus Persson's user avatar
  • 11
0 votes
0 answers
62 views

I have a library that specifies WebSecurity where I'm creating SecurityFilterChain bean. Actually, ManagementWebSecurityAutoConfiguration is annotated with @ConditionalOnDefaultWebSecurity and if my ...
Semyon Volokh's user avatar
  • 33
0 votes
2 answers
125 views

How to set timeouts for ClientCredentials token requests in Spring Security 6.5.1? I'm using Spring Security OAuth2 Client 6.5.1 with ClientCredentials grant type, and need to set connect/read ...
winston's user avatar
  • 59
0 votes
0 answers
44 views

I have an enum with permission values: public enum Permission { DASHBOARD_OPEN("dashboard:open"); private final String key; Permission(String key) { this.key = key; ...
Adam Arold's user avatar
  • 30.8k
0 votes
1 answer
46 views

I am trying to persist data about oauth logged users, but it seems that the method that I have overridden (loadUsers from DefaultOAuth2UserService) is not being called upon login completion. My code ...
Theodor3699's user avatar
  • 1
1 vote
1 answer
657 views

I have this code which I want to migrate: private RequestMatcher[] permittedAntMatchers() { return Stream.concat( "/admin/", "*/admin/" ) ...
Peter Penzov's user avatar
  • 1,102
0 votes
0 answers
87 views

I'm facing an issue with my application which is allowing the user to change the X-XSRF-TOKEN and it's being validated in the backend. For the context: I'm using Spring Boot 2.7.7 and Spring Security ...
Dan's user avatar
  • 1,585
0 votes
0 answers
75 views

I’m using a Spring OAuth2 Authorization Server with a Gateway in front of it. When I access the login page directly via http://localhost:9999 (the OAuth2 server port), everything works: the CSS loads ...
Mast Reyheart's user avatar
  • 83
0 votes
1 answer
103 views

I'm trying to set up a Spring Authorization Server for learning purposes. The login and consent screens work, but after I approve the consent screen and submit the /authorize request, I get the ...
Gaurav Kumar's user avatar
  • 55
3 votes
1 answer
167 views

I have a Spring Security configuration for permitting all requests: @Configuration @EnableWebSecurity @Profile("no-auth") public class NoAuthSecurityConfig { private static final Logger ...
Peter Penzov's user avatar
  • 1,102
1 vote
0 answers
52 views

We upgraded our spring boot application from 2.5.14 to 3.5.5, now POST requests for multipart file upload are failing with a 403 response. This is a service to service interface, no user login is ...
Fredo's user avatar
  • 159
2 votes
2 answers
225 views

I want to disable Spring Security and to allow every request: public class DefaultSecurityConfig { @Bean @Order(1) @Profile("no-authentication") public ...
Peter Penzov's user avatar
  • 1,102
0 votes
0 answers
59 views

I have a Spring Boot application in which a want to use a token (stored in a database table) for authentication. I added an own filter and authentication provider but the provider isn't used. Why is ...
Johni's user avatar
  • 2,980
0 votes
0 answers
68 views

Describe the bug When using UsernamePasswordAuthenticationToken with a char[] password instead of a String, authentication fails. From a security perspective, it is recommended to use char[] to avoid ...
Arun Kumar H's user avatar
  • 1
0 votes
1 answer
85 views

I’m trying to build my own Spring Authorization Server (for learning purposes and possibly to use across multiple projects in the future). I’m already familiar with Spring Security and resource server ...
Gaurav Kumar's user avatar
  • 55
1 vote
0 answers
69 views

Body I’m working on a Spring Cloud Gateway project with Spring Security enabled. I want to cache the request body using the existing CacheRequestBodyGatewayFilterFactory so that the body is available ...
Tala Kafafi's user avatar
  • 11
0 votes
1 answer
39 views

I am using Spring Security 6.4.8. I need to allow an endpoint for initiation of the login, say /fun, in which I need to have certain logic (e.g. do something with a passed parameter). Therefore, I ...
Mateva's user avatar
  • 852
2 votes
1 answer
70 views

Body: I developed an IAM system using Spring Boot where I integrated multi-factor authentication (MFA). Here’s the flow I implemented: A client sends a GET request to /oauth2/authorize. This redirects ...
Heshan Sandaruwan's user avatar
  • 21
0 votes
0 answers
63 views

For a BFF we use tokens to communicate to the backend. We also use MongoDB to save the sessions to the database to enable multiple clusters. I'm trying to enable autoscaling, but unfortunately I don't ...
user1811934's user avatar
  • 21
0 votes
0 answers
417 views

I have a Spring Boot application that uses JWT Token based authentication. The issuer and IDP of the token is Auth0. Sometime back I got an error An error occurred while attempting to decode the Jwt: ...
Chintan Pandya's user avatar
  • 408
-4 votes
1 answer
58 views

/login page seems to be stuck in a loop of being redirected to self. For context, I want /register & /login to be visible without authentication, while all other pages in my project should ...
Sumedh Kudale's user avatar
  • 1
0 votes
1 answer
152 views

I have a spring boot application that uses rest to communicate with clients, this application has 2 types of users: visitors and employees. These 2 users have different authentication methods but they ...
hamdi's user avatar
  • 3

1
2 3 4 5
…
584