2d7679cdda
main change is to force spring security to always send user to welcome.mvc after login which gets their session setup properly before redirecting to start.mvc
51 lines
2.8 KiB
XML
51 lines
2.8 KiB
XML
<beans:beans xmlns="http://www.springframework.org/schema/security"
|
|
xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="http://www.springframework.org/schema/beans
|
|
http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
|
|
http://www.springframework.org/schema/security
|
|
http://www.springframework.org/schema/security/spring-security-3.2.xsd">
|
|
|
|
<global-method-security pre-post-annotations="enabled" />
|
|
<!--
|
|
PCS 8/27/2012
|
|
NOTE: Without Spring security, HttpServletRequest.getUserPrincipal() returns null when called from pages under Spring's control.
|
|
That method is used extensively in legacy webgoat code. Integrating Spring security into the application resolves this issue.
|
|
-->
|
|
<http pattern="/css/**" security="none"/>
|
|
<http pattern="/images/**" security="none"/>
|
|
<http pattern="/javascript/**" security="none"/>
|
|
<http pattern="/js/**" security="none"/>
|
|
<http pattern="/fonts/**" security="none"/>
|
|
<http pattern="/plugins/**" security="none"/>
|
|
<http pattern="/favicon.ico" security="none"/>
|
|
<http use-expressions="true">
|
|
<intercept-url pattern="/login.mvc" access="permitAll" />
|
|
<intercept-url pattern="/logout.mvc" access="permitAll" />
|
|
<intercept-url pattern="/servlet/AdminServlet/**" access="hasAnyRole('ROLE_WEBGOAT_ADMIN','ROLE_SERVER_ADMIN')" />
|
|
<intercept-url pattern="/JavaSource/**" access="hasRole('ROLE_SERVER_ADMIN')" />
|
|
<intercept-url pattern="/**" access="hasAnyRole('ROLE_WEBGOAT_USER','ROLE_WEBGOAT_ADMIN','ROLE_SERVER_ADMIN')" />
|
|
<form-login
|
|
login-page="/login.mvc"
|
|
default-target-url="/welcome.mvc"
|
|
authentication-failure-url="/login.mvc?error"
|
|
username-parameter="username"
|
|
password-parameter="password"
|
|
always-use-default-target="true"/>
|
|
<logout logout-url="/j_spring_security_logout" logout-success-url="/logout.mvc" />
|
|
<!-- enable csrf protection -->
|
|
<!--csrf/-->
|
|
</http>
|
|
|
|
<!-- Authentication Manager -->
|
|
<authentication-manager alias="authenticationManager">
|
|
<authentication-provider>
|
|
<user-service>
|
|
<!-- TODO: credentials in the config - this isn't something I'm proud of - get rid of this ASAP -->
|
|
<user name="guest" password="guest" authorities="ROLE_WEBGOAT_USER" />
|
|
<user name="webgoat" password="webgoat" authorities="ROLE_WEBGOAT_ADMIN" />
|
|
<user name="server" password="server" authorities="ROLE_SERVER_ADMIN" />
|
|
</user-service>
|
|
</authentication-provider>
|
|
</authentication-manager>
|
|
|
|
</beans:beans> |