spring security - how to remove cache control in certain url pattern

Question

I am trying to filter some url pattern to caching. What I have attempted is put some codes into WebSecurityConfigurerAdapter implementation.

 @Override
protected void configure(HttpSecurity http) throws Exception {
    initSecurityConfigService();

    // For cache
    http.headers().defaultsDisabled()
            .cacheControl()
            .and().frameOptions();

    securityConfigService.configure(http,this);
}

However this code will effect all of the web application. How can I apply this to certain URL or Content-Type like images.

I have already tried with RegexRequestMatcher, but it does not work for me.

// For cache
        http.requestMatcher(new RegexRequestMatcher("/page/", "GET"))
                .headers().defaultsDisabled()
                .cacheControl()
                .and().frameOptions();

I read this article : SpringSecurityResponseHeaders, but there is no sample for this case.

Thanks.

P.S. In short, I want to remove SpringSecurity defaults for certain url and resources.

maybe I don't understand your question well. Since you want to add cache control for general requests, why is Spring Security involved in this? Can you try to add a filter for this? — Simon
– Simon, Commented Mar 7, 2017 at 6:09
@Simon Security default settings should valid for general calls, but I want to that option for only image/* Types. That is why I want to separate those options. — Juneyoung Oh
– Juneyoung Oh, Commented Mar 7, 2017 at 7:26
I understand this point, but to me, this is very simple with a filter, you can set up some url pattern(in your case image/*) to filter. You just set some headers in the response, then everything should be set. If you relly prefer Spring Security, it has the filter chain, you just add one filter after the last one and set the response — Simon
– Simon, Commented Mar 7, 2017 at 7:57
Thanks for your answers, Simon, dur. I solved this with Filter like Simon said. — Juneyoung Oh
– Juneyoung Oh, Commented Mar 8, 2017 at 4:23

anand1st · Accepted Answer · 2017-03-07 04:36:04Z

1

What about having multiple WebSecurityConfigurerAdapters? One adapter could have cache controls for certain URLs and another one will not have cache control enabled for those URLs.

answered Mar 7, 2017 at 4:36

anand1st

1,17610 silver badges17 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Juneyoung Oh Over a year ago

This is additional information to help others. To having multiple WebSecurityConfigurerAdapter, have to alter the @Order of the implements. Default is hidden, but value is 100 and it must not be duplicated. can refer this doc

Juneyoung Oh · Accepted Answer · 2017-03-08 04:30:06Z

0

I solved this with Filter. Below is part of my implementation of AbstractAnnotationConfigDispatcherServletInitializer. In onStartup method override.

FilterRegistration.Dynamic springSecurityFilterChain = servletContext.addFilter("springSecurityFilterChain", new DelegatingFilterProxy());
if(springSecurityFilterChain != null){
    springSecurityFilterChain.addMappingForUrlPatterns(EnumSet.of(DispatcherType.REQUEST), true, "/render/*", "/service/*");
    // I removed pattern url "/image/*" :)
}

What I have done is remove /image/* from MappingUrlPatterns. Thanks for your answers!

answered Mar 8, 2017 at 4:30

Juneyoung Oh

7,73420 gold badges79 silver badges128 bronze badges

2 Comments

dur Over a year ago

There is another regular way to do this. Use WebSecurity#ignoring.

Juneyoung Oh Over a year ago

@dur Thanks. That was what I looking for. bb

Collectives™ on Stack Overflow

spring security - how to remove cache control in certain url pattern

2 Answers 2

1 Comment

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related