Databases
StackOverflow2013
Postsdbo
POSpring Security: How to authorize user for a given URL when using multiple `http` elements?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POSpring Security: How to authorize user for a given URL when using multiple `http` elements?
    primarykey
    data
    text
    <p>I have a spring MVC web application built in a modular fashion. Each module that is added to the website may define its own security elements (using <code>http</code> namespace in xml) for user authorization, this is fine and working. </p> <p>I now need to programmatically check if the current user has access to a given URL. I have searched and searched and found many references to the <code>WebInvocationPrivilegeEvaluator</code>, which would be great, except my application currently has 6 of these and I am not sure which one to use (it has 6 <code>&lt;http:</code> elements). I have tried looping all 6 and performing the check on each one, but this returns strange results. </p> <p>Example:</p> <p>I can get all of the beans using the following:</p> <pre><code>private Collection&lt;WebInvocationPrivilegeEvaluator&gt; privEvals; .... privEvals = (List&lt;WebInvocationPrivilegeEvaluator&gt;) applicationContext.getBeansOfType(WebInvocationPrivilegeEvaluator.class).values(); </code></pre> <p>And loop check like this:</p> <pre><code>public void checkForUrl(String url) { for(WebInvocationPrivilegeEvaluator privEval:privEvals) { System.out.println(privEval.isAllowed(url, SecurityContextHolder.getContext().getAuthentication())); } } </code></pre> <p>Example 1: The user is authorized for the URL, prints: <br> false <br> false <br> true<br> true<br> true<br> true<br></p> <p>Example 2: The same user is not authorized for the URL, prints:<br> false <br> false<br> true<br> true<br> true<br> true<br></p> <p>But if I try to browse to the URLs I get the correct <code>403</code> for the second url.</p> <p><strong>Update</strong></p> <p>If I use the other method of <code>WebInvocationPrivilegeEvaluator</code> which accepts context, I get the same result. I have tried many URLs with different <code>http</code> elements securing them, and the same boolean values are returned (in the same order).</p> <p>If I use a different <strong>user</strong> with different roles assigned, I get the same problem where the results are always the same for different URLs (when the user is or isn't authorized to access them), except this time the following is printed:<br> false<br> true<br> true<br> true<br> false<br> true<br></p> <p><strong>Update</strong> </p> <p>I have tried using the <code>&lt;sec:authorize</code> tag with more strange results, it appears as though it is just using the first <code>WebInvocationPrivilegeEvaluator</code>.</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. USDairyLea
    1. USDairyLea
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. COHave you tried the other method of WebInvocationPrivilegeEvaluator that takes context path?
      singulars
      1. POSpring Security: How to authorize user for a given URL when using multiple `http` elements?
      1. USRitesh
    2. COThank you for your comment. I have updated my question in response, but in short yes I have, and no it doesn't work. I'm beginning to think I should just implement my own test that pings the URL and checks response, although I don't really want to do this as it will increase latency...
      singulars
      1. POSpring Security: How to authorize user for a given URL when using multiple `http` elements?
      1. USDairyLea
    3. COok. The authorize JSP tag makes use of it and I have used it several times. Example: <sec:authorize url="/admin/" var="isAdministrator" />. The authorizeUsingUrlCheck method of AbstractAuthorizeTag is using the same code to check authorization.
      singulars
      1. POSpring Security: How to authorize user for a given URL when using multiple `http` elements?
      1. USRitesh
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload