I am trying to use Spring Security 3.0.5 in my web application. Basically, I want to have a web service which return data in json format via HTTP GET.
I have implemented a RESTful service which returns data when the url http://localhost:8080/webapp/json is requested. This works fine with the following curl command
> curl http://localhost:8080/webapp/json
{"key":"values"}
After I added basic authentication using spring security, I can use following commands to get the data
> curl http://localhost:8080/webapp/json
<html><head><title>Apache Tomcat/6.0.29 - Error report .....
> curl -u username:password http://localhost:8080/webapp/json
{"key":"values"}
The former command returns standard tomcat error page since now it requires username and password. My question is whether it is possible to handle access denied in such a way that it prints out my own error message? i.e.
> curl http://localhost:8080/webapp/json
{"error":"401", "message":"Username and password required"}
Here is my spring security configuration and AccessDeniedHandler. As you can see, I am trying to add access-denied-handler which simply prints out a string through servlet response but it still does not print my own message on command line.
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:p="http://www.springframework.org/schema/p"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
<global-method-security secured-annotations="enabled"/>
<beans:bean name="access-denied" class="webapp.error.JSONAccessDeniedHandler"></beans:bean>
<http auto-config="true">
<access-denied-handler ref="access-denied"/>
<intercept-url pattern="/json" access="ROLE_USER,ROLE_ADMIN" />
<http-basic />
</http>
<authentication-manager>
<authentication-provider>
<password-encoder hash="md5"/>
<user-service>
...
</user-service>
</authentication-provider>
</authentication-manager>
</beans:beans>
AccessDeniedHandler.java
package webapp.error;
import java.io.IOException;
import java.io.PrintWriter;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.web.access.AccessDeniedHandler;
public class JSONAccessDeniedHandler implements AccessDeniedHandler {
@Override
public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException {
PrintWriter writer = response.getWriter();
writer.print("{\"error\":\"401\", \"message\":\"Username and password required\"}");
}
}
I have solved my problem so I think I should share it here. This configuration allows server to send out error message differently depending on the requesting software. If the request comes from a web browser, it will check the
User-Agentheader and redirect to a form login if necessary. If the request comes from, for example,curl, it will print out plain text error message when the authentication fails.PlainTextBasicAuthenticationEntryPointby extendingorg.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint