Pfthb

I've developed a REST api's where methods are secured with SpringSecurity.

GITHUB LINK-> Project

It is working but not as expected

SpringSecurity.config

---------------------------

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter

 @Autowired
 private UserDetailsService userDetailService;

 @Override
 protected void configure(AuthenticationManagerBuilder auth) throws Exception 

 auth.userDetailsService(userDetailService).passwordEncoder(encode());


 


 @Override
 protected void configure(HttpSecurity http) throws Exception 


 http
 .csrf().disable();
 http

 .authorizeRequests()
 .antMatchers("/user/**")
 .authenticated()
 .anyRequest()
 .hasAnyRole("USER","ADMIN")
 .and()
 .authorizeRequests()
 .antMatchers("/admin/**")
 .authenticated()
 .anyRequest()
 .hasRole("ADMIN")
 .and()
 .formLogin()
 .permitAll();

 /*http
 .authorizeRequests()
 .antMatchers("/admin/**").hasRole("ADMIN")
 .antMatchers("/user/**").hasAnyRole("USER","ADMIN")
 .anyRequest()
 .authenticated()
 .and()
 .formLogin()
 .permitAll();*/

 

 @Bean
 public BCryptPasswordEncoder encode() 
 return new BCryptPasswordEncoder();
 

AdminController

----------------------

@RestController
@RequestMapping("/admin")
public class AdminController 

 @Autowired
 private UserRepo userRepo;
 @Autowired
 private BCryptPasswordEncoder encoder;

 @PostMapping("/add")
 @PreAuthorize("hasRole('ADMIN')")
 public String addUser(@RequestBody User user) 
 String encodedPwd= encoder.encode(user.getPassword());
 user.setPassword(encodedPwd);
 userRepo.save(user);
 return "user added sucessfully...";
 

 @GetMapping("/demo")
 @PreAuthorize("hasRole('ADMIN')")
 public String getDemo() 
 return "Hi";
 

CustomController

-------------------------

@RestController
@RequestMapping("/user")
public class CustomController 

 @GetMapping("/access")
 @PreAuthorize("hasAnyRole('USER','ADMIN')")
 public String showUser() 

 return "Url Security Provided";
 

CustomUserDetailService

-----------------------------

@Service
public class CustomUserDetailService implements UserDetailsService 

 @Autowired
 private UserRepo userRepo;

 @Override
 public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException 

 User user= userRepo.findByUsername(username);
 CustomUserDetails userDetails= null;

 if(user!= null) 
 userDetails= new CustomUserDetails();
 userDetails.setUser(user);
 else 
 throw new UsernameNotFoundException("User Not Found");
 
 return userDetails;
 

CustomUserDetail

-----------------

@Getter
@Setter
public class CustomUserDetails implements UserDetails 

 /**
 * 
 */
 private static final long serialVersionUID = 1L;
 private User user;


 @Override
 public Collection<? extends GrantedAuthority> getAuthorities() 

 /*return user.getRoles().stream()
 .map(role->new SimpleGrantedAuthority("ROLE_"+ role))
 .collect(Collectors.toList());*/
 return user.getRoles().stream().map(role -> new SimpleGrantedAuthority("ROLE_" + role))
 .collect(Collectors.toList());
 

 @Override
 public String getPassword() 
 // TODO Auto-generated method stub
 return user.getPassword();
 

 @Override
 public String getUsername() 
 // TODO Auto-generated method stub
 return user.getUsername();
 

 @Override
 public boolean isAccountNonExpired() 
 // TODO Auto-generated method stub
 return true;
 

 @Override
 public boolean isAccountNonLocked() 
 // TODO Auto-generated method stub
 return true;
 

 @Override
 public boolean isCredentialsNonExpired() 
 // TODO Auto-generated method stub
 return true;
 

 @Override
 public boolean isEnabled() 
 // TODO Auto-generated method stub
 return true;
 

 public CustomUserDetails() 
 super();
 // TODO Auto-generated constructor stub
 

User

----------

@Entity
@Getter
@Setter
@NoArgsConstructor
public class User 

 @Id
 @GenericGenerator(name="gen",strategy="increment")
 @GeneratedValue(generator="gen")
 private int user_id;
 private String username;
 private String password;
 private String email;
 @OneToMany(cascade= CascadeType.ALL, fetch= FetchType.EAGER)
 @JoinTable(name="user_roles",
 joinColumns= @JoinColumn(referencedColumnName= "user_id"), 
 inverseJoinColumns= @JoinColumn(referencedColumnName="role_id"))
 private Set<Roles> roles;

The problem is:
With the above setup I can access the URL which are for USER not for ADMIN


If i'm commenting

http
 /*.authorizeRequests()
 .antMatchers("/user/**")
 .authenticated()
 .anyRequest()
 .hasRole("USER")
 .and()*/
 .authorizeRequests()
 .antMatchers("/admin/**")
 .authenticated()
 .anyRequest()
 .hasRole("ADMIN")
 .and()
 .formLogin()
 .permitAll();

Then I can access the URL which are for ADMIN but I'm missing authentication on URL which are for USER

Similarly If I'm commenting the admin/ then USER part can be accessed. It behaving like Ordering which ever url is in first it is recognizing that and the second one is simply giving 403 in browser not anything in console.

It is something like Order which is first that can be accessed

Is there anywhere I'm doing wrong.

If I do not comment @EnableGlobalSecurity, @PreAuthorize, I can't access any of the URL those are for ADMIN and USER simply 403, so I cant miss @EnableGlobalSecurity, @PreAuthorize as these are for Securing REST API Methods

Just add permission to all your pages for your admin role. This way you make sure that your admin can access any page he wants.

http
 /*.authorizeRequests()
 .antMatchers("/user/**")
 .authenticated()
 .anyRequest()
 .hasRole("USER")
 .and()*/
 .authorizeRequests()
 .antMatchers("/admin/**")
 .hasRole("ADMIN")
 .antMatchers("/user/**")
 .hasAnyRole("ADMIN", "USER")
 .and()
 .formLogin()
 .permitAll();