Spring Security Filter Mapping - Disable on certain Url Pattern

Question

I have the following servlet definitions:

    <servlet>
        <servlet-name>licenseGenService</servlet-name>
        <servlet-class>org.springframework.web.context.support.HttpRequestHandlerServlet</servlet-class>
    </servlet>

    <servlet-mapping>
        <servlet-name>licenseGenService</servlet-name>
        <url-pattern>/remoting/licensing</url-pattern>
    </servlet-mapping>

    <!-- Restful API Servlet-->
    <servlet>
        <servlet-name>licensingRestService</servlet-name>
        <servlet-class>
            com.sun.jersey.spi.spring.container.servlet.SpringServlet
        </servlet-class>
        <init-param>
            <param-name>
                    com.sun.jersey.config.property.packages
            </param-name>
            <param-value>
                com.mydomain.licensing.rest
            </param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>

    <servlet-mapping>
        <servlet-name>licensingRestService</servlet-name>
        <url-pattern>/*</url-pattern>
    </servlet-mapping>

And then the following security filter:

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>
            org.springframework.web.filter.DelegatingFilterProxy
        </filter-class>
    </filter>


    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

So based on what I have read, url patterns with /* are overwritten by those with explicit urls. This works fine for my servlets. The things is, I do not want basic authentication required for the licenseGenService servlet. How can I define the security filter to only apply to the REST servlet, and not the licenseGenService one?

Apologies, the licenseGenService servlet. I will edit to make it more clear. Its a case of I know what I am trying to type, but I forget the audience — thatidiotguy
– thatidiotguy, Commented Nov 6, 2012 at 19:34
can you map the licensingRestService to /api, then apply security filter to /api? otherwise you will need to programmatically filter out the /remoting/licensing in a filter, then continue to the security filter (ie. filterchain). For example, have your filter take a ignore-patterns param, then check in your filter if the url is in the ignore-patterns before forwarding to next filter in chain. — user553180
– user553180, Commented Nov 6, 2012 at 20:02

Usha · Accepted Answer · 2012-11-06 20:10:30Z

1

You can configure the urls that need to be authorized in the application context xml.

<http use-expressions="true">
  <intercept-url pattern="/remoting/licensing/**"  filters="none" />
</http>

edited Nov 6, 2012 at 20:10

answered Nov 6, 2012 at 20:04

Usha

1,46811 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

thatidiotguy Over a year ago

This is the deprecated version. But thank you you lead me in the right direction.

thatidiotguy · Accepted Answer · 2012-11-06 20:18:09Z

1

I ended up placing the following in my security application context:

<http pattern="/remoting/**" security="none"/>

This works for Spring 3.1

answered Nov 6, 2012 at 20:18

thatidiotguy

9,01114 gold badges66 silver badges109 bronze badges

Collectives™ on Stack Overflow

Spring Security Filter Mapping - Disable on certain Url Pattern

2 Answers 2

1 Comment

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Related