I’m new to Spring Boot, and might not have the grasp on all of spring basis.
My application serves a set of webservices and have a web interface to display some of the data.I’m facing an issue with configuring my application to run both the web interface and web services with different protocols(http/https).This is needed since the web service clients only can run as http(they will be updated in the future).
Here’s my setup:Web Interface (UI) is currently running at endpoint – localhost:port/web/**Web Services (API) is currently running at endpoint – localhost:port/ws/**
Currently my application work if the full application(both web interface and webservices) runs as http.
My application endpoints is configured as follows:
@Bean public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { // Disable LDAP login for All endpoint web services (/ws/**) http .requiresChannel(channelConfigurer -> channelConfigurer.anyRequest().requiresInsecure()) .authorizeHttpRequests(request -> request.requestMatchers(new AntPathRequestMatcher("/ws/**")) .permitAll()); // Enforce LDAP login for the web management interface (/web/**) http .requiresChannel(channelConfigurer -> channelConfigurer.anyRequest().requiresSecure()) .authorizeHttpRequests(request -> request.requestMatchers(new AntPathRequestMatcher("/web/**")) .authenticated().anyRequest().fullyAuthenticated()) .formLogin(Customizer.withDefaults()); http.csrf(AbstractHttpConfigurer::disable); return http.build(); }
Any guidance or examples would be greatly appreciated! Thank you in advance.
To solve the problem I have tried:
Setup the application to use https - but is affected the full application(both web interface and webservices) and could not get it seperated.
I have try to force https to only the web interface endpoint - localhost:port/web/**But it did not work.
@Bean public SecurityFilterChain secureSecurityFilterChain(HttpSecurity httpSecurity) throws Exception { // Configure the security filter chain for secure (HTTPS) requests. return httpSecurity.securityMatcher("/web/**") .requiresChannel(channelConfigure -> channelConfigure .requestMatchers(ServletRequest::isSecure) //.requiresInsecure() // Require HTTP //.requiresSecure() // Require HTTPS ) .authorizeHttpRequests(authorizeRequests -> authorizeRequests .anyRequest().permitAll() // Allow all secure requests ) .build(); }