Examples with AccessDeniedHandler org.springframework.security.web.access.AccessDeniedHandler used on opensource projects

Example 1 with AccessDeniedHandler

use of org.springframework.security.web.access.AccessDeniedHandler in project spring-security by spring-projects.

the class CsrfConfigurer method createAccessDeniedHandler.

/**
	 * Creates the {@link AccessDeniedHandler} from the result of
	 * {@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)} and
	 * {@link #getInvalidSessionStrategy(HttpSecurityBuilder)}. If
	 * {@link #getInvalidSessionStrategy(HttpSecurityBuilder)} is non-null, then a
	 * {@link DelegatingAccessDeniedHandler} is used in combination with
	 * {@link InvalidSessionAccessDeniedHandler} and the
	 * {@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)}. Otherwise, only
	 * {@link #getDefaultAccessDeniedHandler(HttpSecurityBuilder)} is used.
	 *
	 * @param http the {@link HttpSecurityBuilder}
	 * @return the {@link AccessDeniedHandler}
	 */
private AccessDeniedHandler createAccessDeniedHandler(H http) {
    InvalidSessionStrategy invalidSessionStrategy = getInvalidSessionStrategy(http);
    AccessDeniedHandler defaultAccessDeniedHandler = getDefaultAccessDeniedHandler(http);
    if (invalidSessionStrategy == null) {
        return defaultAccessDeniedHandler;
    }
    InvalidSessionAccessDeniedHandler invalidSessionDeniedHandler = new InvalidSessionAccessDeniedHandler(invalidSessionStrategy);
    LinkedHashMap<Class<? extends AccessDeniedException>, AccessDeniedHandler> handlers = new LinkedHashMap<Class<? extends AccessDeniedException>, AccessDeniedHandler>();
    handlers.put(MissingCsrfTokenException.class, invalidSessionDeniedHandler);
    return new DelegatingAccessDeniedHandler(handlers, defaultAccessDeniedHandler);
}

Example 2 with AccessDeniedHandler

use of org.springframework.security.web.access.AccessDeniedHandler in project spring-security by spring-projects.

the class CsrfConfigurer method getDefaultAccessDeniedHandler.

/**
	 * Gets the default {@link AccessDeniedHandler} from the
	 * {@link ExceptionHandlingConfigurer#getAccessDeniedHandler()} or create a
	 * {@link AccessDeniedHandlerImpl} if not available.
	 *
	 * @param http the {@link HttpSecurityBuilder}
	 * @return the {@link AccessDeniedHandler}
	 */
@SuppressWarnings("unchecked")
private AccessDeniedHandler getDefaultAccessDeniedHandler(H http) {
    ExceptionHandlingConfigurer<H> exceptionConfig = http.getConfigurer(ExceptionHandlingConfigurer.class);
    AccessDeniedHandler handler = null;
    if (exceptionConfig != null) {
        handler = exceptionConfig.getAccessDeniedHandler();
    }
    if (handler == null) {
        handler = new AccessDeniedHandlerImpl();
    }
    return handler;
}

Example 3 with AccessDeniedHandler

use of org.springframework.security.web.access.AccessDeniedHandler in project spring-security by spring-projects.

the class CsrfConfigurer method configure.

@SuppressWarnings("unchecked")
@Override
public void configure(H http) throws Exception {
    CsrfFilter filter = new CsrfFilter(this.csrfTokenRepository);
    RequestMatcher requireCsrfProtectionMatcher = getRequireCsrfProtectionMatcher();
    if (requireCsrfProtectionMatcher != null) {
        filter.setRequireCsrfProtectionMatcher(requireCsrfProtectionMatcher);
    }
    AccessDeniedHandler accessDeniedHandler = createAccessDeniedHandler(http);
    if (accessDeniedHandler != null) {
        filter.setAccessDeniedHandler(accessDeniedHandler);
    }
    LogoutConfigurer<H> logoutConfigurer = http.getConfigurer(LogoutConfigurer.class);
    if (logoutConfigurer != null) {
        logoutConfigurer.addLogoutHandler(new CsrfLogoutHandler(this.csrfTokenRepository));
    }
    SessionManagementConfigurer<H> sessionConfigurer = http.getConfigurer(SessionManagementConfigurer.class);
    if (sessionConfigurer != null) {
        sessionConfigurer.addSessionAuthenticationStrategy(new CsrfAuthenticationStrategy(this.csrfTokenRepository));
    }
    filter = postProcess(filter);
    http.addFilter(filter);
}