Cannot secure HTML files using Spring-Security

Question

I have a webapp which I deploy on google appengine. I believe that the issue is not related to GAE, but there is something that I am missing...

Basically, I want to force the user to be authenticated in order to see/use anything that is under /secured dir. I have HTML page that is under this dir, but the user can easily navigate to it (without being authenticated). How do I secure it using SS?

I read this and that, tried it but it did not help :-(

My config - web.xml:

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    <init-param>
        <param-name>contextAttribute</param-name>
        <param-value>org.springframework.web.servlet.FrameworkServlet.CONTEXT.spring</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>


<!-- to integrate Spring with AppEngine project -->
<context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>/WEB-INF/spring-servlet.xml</param-value>
</context-param>

<!-- if we work with Spring-security, we already have a listener -->
<!-- listener>
    <listener-class>
        org.springframework.web.context.ContextLoaderListener
    </listener-class>
</listener-->


<servlet>
    <servlet-name>spring</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>

<servlet-mapping>
    <servlet-name>spring</servlet-name>
    <url-pattern>/</url-pattern>
</servlet-mapping>

spring-servlet.xml:

<context:annotation-config />

<context:property-placeholder location="classpath:client.properties" />

<context:component-scan base-package="com.nice.coffee" />
<context:component-scan base-package="com.ohadr.auth_flows" />
<context:component-scan base-package="com.ohadr.crypto" />

<mvc:annotation-driven />
<mvc:default-servlet-handler />

<!-- dont use debug! https://jira.spring.io/browse/SEC-1885 >
<sec:debug />
 -->

 <mvc:resources mapping="/secured/**" location="/secured/" />


<sec:http pattern="/login/**" security="none" />
<sec:http pattern="/forgotPasswordPage" security="none" />
<sec:http pattern="/forgotPassword" security="none" />
<sec:http pattern="/createAccountPage" security="none" />
<sec:http pattern="/createAccount" security="none" />

<sec:http authentication-manager-ref="authenticationManager">
    <sec:intercept-url pattern="/**/ohad.html" access="ROLE_ADMIN" />  
    <sec:intercept-url pattern="/secured/**" access="ROLE_USER" />
    <sec:anonymous />

    <sec:form-login login-page="/login/login.htm"
        authentication-success-handler-ref="authenticationSuccessHandler"
        authentication-failure-handler-ref="authenticationFailureHandler" />

</sec:http>



<sec:authentication-manager alias="authenticationManager">
    <sec:authentication-provider
        user-service-ref="userDetailsService">
        <sec:password-encoder hash="sha-256">
            <sec:salt-source user-property="username" />
        </sec:password-encoder>
    </sec:authentication-provider>
</sec:authentication-manager>...

my proj hierarchy:

...thanks in advance!

Answer 1

It appears that my problem was in this line:

 <mvc:resources mapping="/secured/**" location="/secured/" />

spring-mvc is "confused" where both location and mapping are with the same name. So when a request to a resource enters the application, e.g. .../secured/my.html, spring-mvc does not use the mapping at all.

The solution was to change the location name (or the mapping, but I changed the location-name) so i ended up with:

 <mvc:resources mapping="/secured/**" location="/secured_resources/" />

and all my resources (html, JS, etc) were under a dir called 'secured_resources'. Then, when a request arrived to the application, e.g .../secured/my.html, it was mapped successfully using MVC, hence the browser is redirected to login page, etc.

Answer 2

Rather than putting the secured pags under src/main/webapp/secured, which get served up directly, put them in src/main/resources/secured, and change your resources statement to

<mvc:resources mapping="/secured/**" location="classpath:/secured/" />