I'm trying to learn Spring Boot by writing a simple REST application that would log users in (POST /login) and display info about current user (GET /). I'm using Redis for sessions.
POST /login works as expected: it returns the principal and sets the session cookie both in browser and Redis.
Consequent GET / requests, however, returns anonymousUser. What am I missing?
pom.xml:
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-redis</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.session</groupId>
<artifactId>spring-session-data-redis</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
application.properties:
spring.session.store-type=redis
server.servlet.session.timeout=3600s
spring.session.redis.flush-mode=on-save
spring.session.redis.namespace=spring:session
spring.redis.host=localhost
spring.redis.port=6379
IndexController.java:
@Controller
public class IndexController {
private AuthenticationManager authenticationManager;
IndexController(AuthenticationManager authenticationManager) {
this.authenticationManager = authenticationManager;
}
@GetMapping
ResponseEntity index(HttpServletRequest request, HttpSession session) {
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
return new ResponseEntity<>(authentication.getPrincipal(), HttpStatus.OK);
}
@PostMapping("/login")
ResponseEntity login(@RequestBody LoginRequest loginRequest) {
String username = loginRequest.getUsername();
String password = loginRequest.getPassword();
UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, password);
Authentication authentication = this.authenticationManager.authenticate(token);
return new ResponseEntity<>(authentication.getPrincipal(), HttpStatus.OK);
}
}
Config.java:
@EnableGlobalMethodSecurity(prePostEnabled = true)
@EnableWebSecurity
@EnableRedisHttpSession
@Configuration
public class Config extends WebSecurityConfigurerAdapter {
@Autowired
private CustomUserDetailsService userDetailsService;
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Bean
@Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService);
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.ALWAYS)
.and()
.csrf()
.disable()
.authorizeRequests()
.anyRequest()
.permitAll();
}
}
