Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Spring Security form login only offers application/json req body type when login page customized #2302

Closed
isaladkou opened this issue Jul 11, 2023 · 2 comments
Labels
wontfix This will not be worked on

Comments

@isaladkou
Copy link

isaladkou commented Jul 11, 2023

Describe the bug
This bug is related to #1931
The solution 9c03b6f depends on DefaultLoginPageGeneratingFilter presence. And so it works only if default form is used. But if the login page customized it doesn't work.
To Reproduce
I'm using SpringBoot 2.7.5 and Spring Security 5.7.4. Other project dependencies:

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springdoc</groupId>
        <artifactId>springdoc-openapi-ui</artifactId>
        <version>1.7.0</version>
    </dependency>
    <dependency>
        <groupId>org.springdoc</groupId>
        <artifactId>springdoc-openapi-security</artifactId>
        <version>1.7.0</version>
    </dependency>
</dependencies>

Supplying property: springdoc.show-login-endpoint=true

Spring security simple config:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .authorizeRequests()
                .antMatchers("/v3/api-docs/**",
                        "/swagger-ui/**",
                        "/swagger-ui.html").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/notdefault");
        return http.build();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth, PasswordEncoder passwordEncoder) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("user")
                .password(passwordEncoder.encode("password"))
                .roles("USER");
    }

}

A simple controller:

@RestController
@RequestMapping("foos")
public class FooController {

    @GetMapping(value = "/{id}")
    public Foo findById(@PathVariable("id") final Long id) {
        return new Foo(randomAlphabetic(6));
    }

    @GetMapping
    public List<Foo> findAll() {
        return Lists.newArrayList(new Foo(randomAlphabetic(6)));
    }

    @PostMapping
    @ResponseStatus(HttpStatus.CREATED)
    public Foo create(@RequestBody final Foo foo) {
        return foo;
    }
}

Expected behavior
I would have expected that form-login authentication configuration would be detected and the exposed Spring Security's detected login endpoint to be exposed with the option for x-www-form-urlencoded body type to be available.

Screenshots
Screenshot_1

https://drive.google.com/file/d/1LYJ9zkE0m4emA96AmITds1KxT90I6rxj/view?usp=drive_link

Additional context
I have also created this repo with the sample code: https://github.com/isaladkou/springdoc-form-login

@isaladkou isaladkou changed the title Spring Security form login only offers application/json req body type whem login page customized Spring Security form login only offers application/json req body type when login page customized Jul 11, 2023
@bnasslahsen
Copy link
Contributor

springdoc-openapi v1.7.0 is the latest Open Source release supporting Spring Boot 2.x and 1.x.

An extended support for springdoc-openapi v1
project is now available for organizations that need support beyond 2023.

For more details, feel free to reach out: sales@springdoc.org

@bnasslahsen bnasslahsen added the wontfix This will not be worked on label Jul 16, 2023
@xmichael91
Copy link

Hello, @bnasslahsen! This bug also applies to springdoc-openapi v2.3.0.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
wontfix This will not be worked on
Projects
None yet
Development

No branches or pull requests

3 participants