0

Tengo configurada la funcionalidad de Spring Security y en la base de datos tengo un rol de user y defino en SecurityConfiguration @PreAuthorize("hasRole('ROLE_ADMIN')") para que solo el rol de ADMIN tenga acceso a la ruta @GetMapping("/contactform") que es el formulario que permite hacer el CRUD de contactos, sinembargo sin importar que me loguee con user que tiene perfil user de igual forma me deja acceder a la funcionalidad del CRUD, debiendo mostrar una p[agina en blanco y no el acceso al formulario de contactos. Si doy clic en el boton accept crea el registro.

Formulario de contactos Tabla user_roles Tabla users

Anexo link del repositorio: https://github.com/hgarciaospina/Curso-Spring-4.git


SecurityConfiguration

package com.udemy.configuration;

    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.beans.factory.annotation.Qualifier;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;


    @Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(prePostEnabled=true)
    public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

        @Autowired
        @Qualifier("userService")
        private UserDetailsService userService;

        @Autowired
        protected void configureGlobal(AuthenticationManagerBuilder auth )throws Exception {
            auth.userDetailsService(userService).passwordEncoder(new BCryptPasswordEncoder());
        }

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.authorizeRequests()
                .antMatchers("/css/*", "/imgs/*").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin().loginPage("/login").loginProcessingUrl("/logincheck")
                .usernameParameter("username").passwordParameter("password")
                .defaultSuccessUrl("/loginsuccess").permitAll()
                .and()
                .logout().logoutUrl("/logout").logoutSuccessUrl("/login?logout")
                .permitAll();
        }

    }

ContactController

package com.udemy.controller;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.ModelAttribute;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.servlet.ModelAndView;

import com.udemy.constant.ViewConstant;
import com.udemy.model.ContactModel;
import com.udemy.service.ContactService;

@Controller
@RequestMapping("/contacts")
public class ContactController {

    private static final Log LOGGER = LogFactory.getLog(ContactController.class);

    @Autowired
    @Qualifier("contactServiceImpl")
    private ContactService contactService;

    @GetMapping("/cancel")
    public String cancel() {
        return "redirect:/contacts/showcontacts";

    }

    @PreAuthorize("hasRole('ROLE_ADMIN')")
    @GetMapping("/contactform")
    private String redirectContactForm(@RequestParam(name="id", required=false) int id,
            Model model) {
        ContactModel contact = new ContactModel();
        if(id != 0) {
            contact = contactService.findContactByIdModel(id);
        }   
        model.addAttribute("contactModel", contact);
        return ViewConstant.CONTACT_FORM;

    }

    @PostMapping("/addcontact")
    public String addContact(@ModelAttribute(name = "contactModel") ContactModel contactModel, Model model) {
        LOGGER.info("METHOD: addContact() -- PARAMS: error =" + contactModel.toString());

        if (null != contactService.addContact(contactModel)) {
            model.addAttribute("result", 1);

        } else {
            model.addAttribute("result", 0);
        }

        return "redirect:/contacts/showcontacts";

    }

    @GetMapping("/showcontacts")
    public ModelAndView showContacts() {
        ModelAndView mav = new ModelAndView(ViewConstant.CONTACTS);
        mav.addObject("contacts", contactService.listAllContacts());
        return mav;
    }

    @GetMapping("/removecontact")
    public ModelAndView removeContact(@RequestParam(name="id", required=true) int id) {
        contactService.removeContact(id);;
        return showContacts();
    }

}

LoginController

package com.udemy.controller;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;

import com.udemy.constant.ViewConstant;

@Controller
public class LoginController {

    private static final Log LOGGER =  LogFactory.getLog(LoginController.class);

    @GetMapping("/login")
    public String showLoginForm(Model model,
            @RequestParam(name="error", required=false) String error,
            @RequestParam(name="logout", required=false) String logout) {
        LOGGER.info("METHOD: showLoginForm() -- PARAMS: error =" + error + ", logout: " + logout);
        model.addAttribute("error", error);
        model.addAttribute("logout", logout);
        LOGGER.info("Return to login view");
        return ViewConstant.LOGIN;

    }

    @GetMapping({"/loginsuccess", "/"})
    public String loginCheck() {
        LOGGER.info("METHOD: loginCheck()");
        LOGGER.info("Return to contacts view");
        return "redirect:/contacts/showcontacts";

    }

}

1 respuesta 1

0

El error era causado porque el ámbito estaba como private en el método:

private String redirectContactForm(@RequestParam(name="id", required=false) int id,, siendo 

lo correcto que fuera public:


Correción

public String redirectContactForm(@RequestParam(name="id", required=false) int id,

Tu Respuesta

Al pulsar en “Publica tu respuesta”, muestras tu consentimiento a nuestros términos de servicio, política de privacidad y política de cookies

¿No es la respuesta que buscas? Examina otras preguntas con la etiqueta o formula tu propia pregunta.