I am replicating one of my previous answers here: If you are using Spring 3.1 this handlerMapping component is an instance of RequestMappingHandlerMapping, which you can query to find the handlerMappedMethods and the associated controllers, along these lines(if you are on an older version of Spring, you should be able to use a similar approach): … Read more
You can dilute the default spring security firewall using your custom defined instance of StrictHttpFirewall (at your own risk) @Bean public HttpFirewall allowUrlEncodedSlashHttpFirewall() { StrictHttpFirewall firewall = new StrictHttpFirewall(); firewall.setAllowUrlEncodedSlash(true); firewall.setAllowSemicolon(true); return firewall; } And then use this custom firewall bean in WebSecurity (Spring boot does not need this change) @Override public void configure(WebSecurity web) … Read more
On the off chance someone else wants to achieve the same thing, it actually is very simple. You can directly return aorg.springframework.http.converter.json.MappingJacksonValue instance from your controller that contains both the object that you want to serialise and the view class. This will be picked up by the org.springframework.http.converter.json.AbstractJackson2HttpMessageConverter#writeInternal method and the appropriate view will be … Read more
After couple of hours of struggling, I’ve finally found the solution. In short, ContentCachingResponseWrapper.copyBodyToResponse() should be called in the end of the filter method. ContentCachingResponseWrapper caches the response body by reading it from response output stream. So, the stream becomes empty. To write response back to the output stream ContentCachingResponseWrapper.copyBodyToResponse() should be used.
Following steps can be taken to implement the interceptor with Spring: Implement an interceptor class extending HandlerInterceptorAdapter class. Following is how the code could look like: public class LoginInterceptor extends HandlerInterceptorAdapter { @Override public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception exception) throws Exception { // TODO Auto-generated method stub } @Override public void … Read more
There is no better way. Both are perfectly valid. Which one you choose to use depends which one suits your application better – Spring allows you to do it either way. Historically, the two approaches come from different versions of Spring. The ModelAndView approach was the primary way of returning both model and view information … Read more
Spring Security Documentation mentions the reason for blocking // in the request. For example, it could contain path-traversal sequences (like /../) or multiple forward slashes (//) which could also cause pattern-matches to fail. Some containers normalize these out before performing the servlet mapping, but others don’t. To protect against issues like these, FilterChainProxy uses an … Read more
In request (action) based MVC, a single front controller servlet will delegate to action models based on request URL/params. You work directly with raw HttpServletRequest and HttpServletResponse objects in the action model. You’ve to write code yourself to gather, convert and validate the request parameters and if necessary update the model values before you can … Read more
One option is to work with profiles. Create a file called application-test.yml, move all properties you need for those tests to that file and then add the @ActiveProfiles annotation to your test class: @RunWith(SpringJUnit4ClassRunner.class) @SpringApplicationConfiguration(classes = Application.class) @WebAppConfiguration @IntegrationTest @ActiveProfiles(“test”) // Like this public class MyIntTest{ } Be aware, it will additionally load the application-test.yml, … Read more
We need to add CharacterEncodingFilter before filters who read request properties for the first time. There is securityFilterChain (stands second. after metrica filter) and we can add our filter inside it. The first filter (inside security chain) who reads properties is CsrfFilter, so we place CharacterEncodingFilter before it. The short solution is: @Configuration @EnableWebMvcSecurity public … Read more