0

Tengo configurada la funcionalidad de Spring Security y en la base de datos tengo un rol de user y defino en SecurityConfiguration @PreAuthorize("hasRole('ROLE_ADMIN')") para que solo el rol de ADMIN tenga acceso a la ruta @GetMapping("/contactform") que es el formulario que permite hacer el CRUD de contactos, sinembargo sin importar que me loguee con user que tiene perfil user de igual forma me deja acceder a la funcionalidad del CRUD, debiendo mostrar una p[agina en blanco y no el acceso al formulario de contactos. Si doy clic en el boton accept crea el registro.

Formulario de contactos Tabla user_roles Tabla users

Anexo link del repositorio: https://github.com/hgarciaospina/Curso-Spring-4.git


SecurityConfiguration

package com.udemy.configuration;

    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.beans.factory.annotation.Qualifier;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;


    @Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(prePostEnabled=true)
    public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

        @Autowired
        @Qualifier("userService")
        private UserDetailsService userService;

        @Autowired
        protected void configureGlobal(AuthenticationManagerBuilder auth )throws Exception {
            auth.userDetailsService(userService).passwordEncoder(new BCryptPasswordEncoder());
        }

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests()
                .antMatchers("/css/*", "/imgs/*").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin().loginPage("/login").loginProcessingUrl("/logincheck")
                .usernameParameter("username").passwordParameter("password")
                .defaultSuccessUrl("/loginsuccess").permitAll()
                .and()
                .logout().logoutUrl("/logout").logoutSuccessUrl("/login?logout")
                .permitAll();
        }

    }

ContactController

package com.udemy.controller;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.servlet.ModelAndView;

import com.udemy.constant.ViewConstant;
import com.udemy.model.ContactModel;
import com.udemy.service.ContactService;

@Controller
@RequestMapping("/contacts")
public class ContactController {

    private static final Log LOGGER = LogFactory.getLog(ContactController.class);

    @Autowired
    @Qualifier("contactServiceImpl")
    private ContactService contactService;

    @GetMapping("/cancel")
    public String cancel() {
        return "redirect:/contacts/showcontacts";

    }

    @PreAuthorize("hasRole('ROLE_ADMIN')")
    @GetMapping("/contactform")
    private String redirectContactForm(@RequestParam(name="id", required=false) int id,
            Model model) {
        ContactModel contact = new ContactModel();
        if(id != 0) {
            contact = contactService.findContactByIdModel(id);
        }   
        model.addAttribute("contactModel", contact);
        return ViewConstant.CONTACT_FORM;

    }

    @PostMapping("/addcontact")
    public String addContact(@ModelAttribute(name = "contactModel") ContactModel contactModel, Model model) {
        LOGGER.info("METHOD: addContact() -- PARAMS: error =" + contactModel.toString());

        if (null != contactService.addContact(contactModel)) {
            model.addAttribute("result", 1);

        } else {
            model.addAttribute("result", 0);
        }

        return "redirect:/contacts/showcontacts";

    }

    @GetMapping("/showcontacts")
    public ModelAndView showContacts() {
        ModelAndView mav = new ModelAndView(ViewConstant.CONTACTS);
        mav.addObject("contacts", contactService.listAllContacts());
        return mav;
    }

    @GetMapping("/removecontact")
    public ModelAndView removeContact(@RequestParam(name="id", required=true) int id) {
        contactService.removeContact(id);;
        return showContacts();
    }

}

LoginController

package com.udemy.controller;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;

import com.udemy.constant.ViewConstant;

@Controller
public class LoginController {

    private static final Log LOGGER =  LogFactory.getLog(LoginController.class);

    @GetMapping("/login")
    public String showLoginForm(Model model,
            @RequestParam(name="error", required=false) String error,
            @RequestParam(name="logout", required=false) String logout) {
        LOGGER.info("METHOD: showLoginForm() -- PARAMS: error =" + error + ", logout: " + logout);
        model.addAttribute("error", error);
        model.addAttribute("logout", logout);
        LOGGER.info("Return to login view");
        return ViewConstant.LOGIN;

    }

    @GetMapping({"/loginsuccess", "/"})
    public String loginCheck() {
        LOGGER.info("METHOD: loginCheck()");
        LOGGER.info("Return to contacts view");
        return "redirect:/contacts/showcontacts";

    }

}

1 respuesta 1

0

El error era causado porque el ámbito estaba como private en el método:

private String redirectContactForm(@RequestParam(name="id", required=false) int id,, siendo 

lo correcto que fuera public:


Correción

public String redirectContactForm(@RequestParam(name="id", required=false) int id,

Tu Respuesta

By clicking “Publica tu respuesta”, you agree to our terms of service and acknowledge you have read our privacy policy.

¿No es la respuesta que buscas? Examina otras preguntas con la etiqueta o formula tu propia pregunta.