Examples with NegatedRequestMatcher org.springframework.security.web.util.matcher.NegatedRequestMatcher used on opensource projects

Example 1 with NegatedRequestMatcher

use of org.springframework.security.web.util.matcher.NegatedRequestMatcher in project ma-core-public by infiniteautomation.

the class MangoSecurityConfiguration method createBrowserHtmlRequestMatcher.

/**
 * Internal method to create a static matcher
 * @return
 */
private static RequestMatcher createBrowserHtmlRequestMatcher() {
    ContentNegotiationStrategy contentNegotiationStrategy = contentNegotiationStrategy();
    MediaTypeRequestMatcher mediaMatcher = new MediaTypeRequestMatcher(contentNegotiationStrategy, MediaType.APPLICATION_XHTML_XML, MediaType.TEXT_HTML);
    mediaMatcher.setIgnoredMediaTypes(Collections.singleton(MediaType.ALL));
    RequestMatcher notXRequestedWith = new NegatedRequestMatcher(new RequestHeaderRequestMatcher("X-Requested-With", "XMLHttpRequest"));
    return new AndRequestMatcher(Arrays.asList(notXRequestedWith, mediaMatcher));
}

Example 2 with NegatedRequestMatcher

use of org.springframework.security.web.util.matcher.NegatedRequestMatcher in project molgenis by molgenis.

the class MolgenisWebAppSecurityConfig method configure.

@Override
protected void configure(HttpSecurity http) throws Exception {
    // do not write cache control headers for static resources
    RequestMatcher matcher = new NegatedRequestMatcher(new OrRequestMatcher(new AntPathRequestMatcher(PATTERN_CSS), new AntPathRequestMatcher(PATTERN_JS), new AntPathRequestMatcher(PATTERN_IMG), new AntPathRequestMatcher(PATTERN_FONTS)));
    DelegatingRequestMatcherHeaderWriter cacheControlHeaderWriter = new DelegatingRequestMatcherHeaderWriter(matcher, new CacheControlHeadersWriter());
    http.sessionManagement().invalidSessionStrategy(invalidSessionStrategy());
    // add default header options but use custom cache control header writer
    http.headers().contentTypeOptions().and().xssProtection().and().httpStrictTransportSecurity().and().frameOptions().and().addHeaderWriter(cacheControlHeaderWriter);
    http.addFilterBefore(anonymousAuthFilter(), AnonymousAuthenticationFilter.class);
    http.authenticationProvider(anonymousAuthenticationProvider());
    http.authenticationProvider(tokenAuthenticationProvider());
    http.authenticationProvider(runAsAuthenticationProvider());
    http.addFilterBefore(tokenAuthenticationFilter(), AnonymousAuthenticationFilter.class);
    http.addFilterBefore(googleAuthenticationProcessingFilter(), TokenAuthenticationFilter.class);
    http.addFilterAfter(changePasswordFilter(), SwitchUserFilter.class);
    http.addFilterAfter(twoFactorAuthenticationFilter(), MolgenisChangePasswordFilter.class);
    http.authenticationProvider(twoFactorAuthenticationProvider());
    http.authenticationProvider(recoveryAuthenticationProvider());
    ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry expressionInterceptUrlRegistry = http.authorizeRequests();
    configureUrlAuthorization(expressionInterceptUrlRegistry);
    expressionInterceptUrlRegistry.antMatchers(MolgenisLoginController.URI).permitAll().antMatchers(TwoFactorAuthenticationController.URI + "/**").permitAll().antMatchers(GOOGLE_AUTHENTICATION_URL).permitAll().antMatchers("/beacon/**").permitAll().antMatchers("/logo/**").permitAll().antMatchers("/molgenis.py").permitAll().antMatchers("/molgenis.R").permitAll().antMatchers(AccountController.CHANGE_PASSWORD_URI).authenticated().antMatchers("/account/**").permitAll().antMatchers(PATTERN_SWAGGER).permitAll().antMatchers(PATTERN_CSS).permitAll().antMatchers(PATTERN_IMG).permitAll().antMatchers(PATTERN_JS).permitAll().antMatchers(PATTERN_FONTS).permitAll().antMatchers("/html/**").permitAll().antMatchers("/plugin/void/**").permitAll().antMatchers("/api/**").permitAll().antMatchers("/webjars/**").permitAll().antMatchers("/search").permitAll().antMatchers("/captcha").permitAll().antMatchers("/dataindexerstatus").authenticated().antMatchers("/permission/**/read/**").permitAll().antMatchers("/permission/**/write/**").permitAll().antMatchers("/scripts/**/run").authenticated().antMatchers("/scripts/**/start").authenticated().antMatchers("/files/**").permitAll().antMatchers('/' + PATH_SEGMENT_APPS + "/**").permitAll().anyRequest().denyAll().and().httpBasic().authenticationEntryPoint(authenticationEntryPoint()).and().formLogin().loginPage(MolgenisLoginController.URI).failureUrl(MolgenisLoginController.URI + "?error").and().logout().deleteCookies("JSESSIONID").addLogoutHandler((req, res, auth) -> {
        if (req.getSession(false) != null && req.getSession().getAttribute("continueWithUnsupportedBrowser") != null) {
            req.setAttribute("continueWithUnsupportedBrowser", true);
        }
    }).logoutSuccessHandler((req, res, auth) -> {
        StringBuilder logoutSuccessUrl = new StringBuilder("/");
        if (req.getAttribute("continueWithUnsupportedBrowser") != null) {
            logoutSuccessUrl.append("?continueWithUnsupportedBrowser=true");
        }
        SimpleUrlLogoutSuccessHandler logoutSuccessHandler = new SimpleUrlLogoutSuccessHandler();
        logoutSuccessHandler.setDefaultTargetUrl(logoutSuccessUrl.toString());
        logoutSuccessHandler.onLogoutSuccess(req, res, auth);
    }).and().csrf().disable();
}

Example 3 with NegatedRequestMatcher

use of org.springframework.security.web.util.matcher.NegatedRequestMatcher in project spring-security by spring-projects.

the class RequestCacheConfigurer method createDefaultSavedRequestMatcher.

@SuppressWarnings("unchecked")
private RequestMatcher createDefaultSavedRequestMatcher(H http) {
    RequestMatcher notFavIcon = new NegatedRequestMatcher(new AntPathRequestMatcher("/**/favicon.*"));
    RequestMatcher notXRequestedWith = new NegatedRequestMatcher(new RequestHeaderRequestMatcher("X-Requested-With", "XMLHttpRequest"));
    boolean isCsrfEnabled = http.getConfigurer(CsrfConfigurer.class) != null;
    List<RequestMatcher> matchers = new ArrayList<>();
    if (isCsrfEnabled) {
        RequestMatcher getRequests = new AntPathRequestMatcher("/**", "GET");
        matchers.add(0, getRequests);
    }
    matchers.add(notFavIcon);
    matchers.add(notMatchingMediaType(http, MediaType.APPLICATION_JSON));
    matchers.add(notXRequestedWith);
    matchers.add(notMatchingMediaType(http, MediaType.MULTIPART_FORM_DATA));
    matchers.add(notMatchingMediaType(http, MediaType.TEXT_EVENT_STREAM));
    return new AndRequestMatcher(matchers);
}

Example 4 with NegatedRequestMatcher

use of org.springframework.security.web.util.matcher.NegatedRequestMatcher in project spring-security by spring-projects.

the class OAuth2ResourceServerConfigurer method registerDefaultEntryPoint.

private void registerDefaultEntryPoint(H http) {
    ExceptionHandlingConfigurer<H> exceptionHandling = http.getConfigurer(ExceptionHandlingConfigurer.class);
    if (exceptionHandling != null) {
        ContentNegotiationStrategy contentNegotiationStrategy = http.getSharedObject(ContentNegotiationStrategy.class);
        if (contentNegotiationStrategy == null) {
            contentNegotiationStrategy = new HeaderContentNegotiationStrategy();
        }
        MediaTypeRequestMatcher restMatcher = new MediaTypeRequestMatcher(contentNegotiationStrategy, MediaType.APPLICATION_ATOM_XML, MediaType.APPLICATION_FORM_URLENCODED, MediaType.APPLICATION_JSON, MediaType.APPLICATION_OCTET_STREAM, MediaType.APPLICATION_XML, MediaType.MULTIPART_FORM_DATA, MediaType.TEXT_XML);
        restMatcher.setIgnoredMediaTypes(Collections.singleton(MediaType.ALL));
        MediaTypeRequestMatcher allMatcher = new MediaTypeRequestMatcher(contentNegotiationStrategy, MediaType.ALL);
        allMatcher.setUseEquals(true);
        RequestMatcher notHtmlMatcher = new NegatedRequestMatcher(new MediaTypeRequestMatcher(contentNegotiationStrategy, MediaType.TEXT_HTML));
        RequestMatcher restNotHtmlMatcher = new AndRequestMatcher(Arrays.<RequestMatcher>asList(notHtmlMatcher, restMatcher));
        RequestMatcher preferredMatcher = new OrRequestMatcher(Arrays.asList(this.requestMatcher, X_REQUESTED_WITH, restNotHtmlMatcher, allMatcher));
        exceptionHandling.defaultAuthenticationEntryPointFor(this.authenticationEntryPoint, preferredMatcher);
    }
}

Example 5 with NegatedRequestMatcher

use of org.springframework.security.web.util.matcher.NegatedRequestMatcher in project spring-security by spring-projects.

the class OAuth2LoginBeanDefinitionParser method getLoginEntryPoint.

private Map<RequestMatcher, AuthenticationEntryPoint> getLoginEntryPoint(Element element) {
    Map<RequestMatcher, AuthenticationEntryPoint> entryPoints = null;
    Element clientRegsElt = DomUtils.getChildElementByTagName(element.getOwnerDocument().getDocumentElement(), Elements.CLIENT_REGISTRATIONS);
    if (clientRegsElt != null) {
        List<Element> clientRegList = DomUtils.getChildElementsByTagName(clientRegsElt, ELT_CLIENT_REGISTRATION);
        if (clientRegList.size() == 1) {
            RequestMatcher loginPageMatcher = new AntPathRequestMatcher(DEFAULT_LOGIN_URI);
            RequestMatcher faviconMatcher = new AntPathRequestMatcher("/favicon.ico");
            RequestMatcher defaultEntryPointMatcher = this.getAuthenticationEntryPointMatcher();
            RequestMatcher defaultLoginPageMatcher = new AndRequestMatcher(new OrRequestMatcher(loginPageMatcher, faviconMatcher), defaultEntryPointMatcher);
            RequestMatcher notXRequestedWith = new NegatedRequestMatcher(new RequestHeaderRequestMatcher("X-Requested-With", "XMLHttpRequest"));
            Element clientRegElt = clientRegList.get(0);
            entryPoints = new LinkedHashMap<>();
            entryPoints.put(new AndRequestMatcher(notXRequestedWith, new NegatedRequestMatcher(defaultLoginPageMatcher)), new LoginUrlAuthenticationEntryPoint(DEFAULT_AUTHORIZATION_REQUEST_BASE_URI + "/" + clientRegElt.getAttribute(ATT_REGISTRATION_ID)));
        }
    }
    return entryPoints;
}