drewreed2005
commented
8 months ago "Show API access code and error handling, specifically redirect on 403"
I'll go over this stuff in this reply. It doesn't seem like this has anything at all to do with deployment, so I went over all of the relevant info I could find to include.
API Access Code
All API access control info can be found in ApiController files. For example, PersonApiController.java.
/*
GET List of People
*/
@GetMapping("/")
public ResponseEntity<List<Person>> getPeople() {
return new ResponseEntity<>( repository.findAllByOrderByNameAsc(), HttpStatus.OK);
}
/*
POST Aa record by Requesting Parameters from URI
*/
@PostMapping( "/post")
public ResponseEntity<Object> postPerson(@RequestParam("email") String email,
@RequestParam("password") String password,
@RequestParam("name") String name,
@RequestParam("dob") String dobString) {
Date dob;
try {
dob = new SimpleDateFormat("MM-dd-yyyy").parse(dobString);
} catch (Exception e) {
return new ResponseEntity<>(dobString +" error; try MM-dd-yyyy", HttpStatus.BAD_REQUEST);
}
// A person object WITHOUT ID will create a new record with default roles as student
Person person = new Person(email, password, name, dob);
personDetailsService.save(person);
return new ResponseEntity<>(email +" is created successfully", HttpStatus.CREATED);
}These are all methods that have specific CRUD assignment (GET and POST for these) and URL mappings (/post, /{id}, etc.) that can be used to fetch the API data. This is all very basic stuff. The code within the method is what fetches/modifies the persistent data in the database on the backend according to the method specified by the URL.
Error Handling and 403 Redirect
This is where this specific topic is weird, since he says "specifically redirect on 403". A 403 error is essentially "Access Denied": it's the error that should be flagged if a user tries to make a call to a method without the proper authority to do so.
SecurityConfig Error Handler
The base Spring repository comes with specifications for error handling in CORS/authentication policy. It can be found in the SecurityConfig.java file.
The code below is from our Roles lesson backend, so it has specific roles-based authority requirements for some methods ("ROLE_ADMIN" for mvc update, delete, and API post and delete). In a non-customized backend, it just has .authenticated(), which simply requires basic user login.
.authorizeHttpRequests(auth -> auth
.requestMatchers("/authenticate").permitAll()
.requestMatchers("/mvc/person/update/**",
"/mvc/person/delete/**").hasAnyAuthority("ROLE_ADMIN")
.requestMatchers("/api/person/post/**", "/api/person/delete/**").hasAnyAuthority("ROLE_ADMIN")
.requestMatchers("/**").permitAll()
)A person's role found by searching for the user associated with the username (email) stored in the JWT received after signing in. This is stuff from our lesson, so I won't go too far into it, but essentially, the user's roles are searched through when a user is loaded by username (email, for whatever reason) and then used as authorities when a request is made.
If the role requirements are not met, the error handler code is called (found below the code above and some other headers in SecurityConfig.java):
// session won't be used to store user's state.
.exceptionHandling(exceptions -> exceptions
.authenticationEntryPoint(jwtAuthenticationEntryPoint)
)Keep the code above in mind for the following section.
403 Redirect
The base Spring repository that we all clone doesn't come with an explicit redirect system for 403 errors. The code provides an entry point for authentication by interpreting the content of the JWT with the object jwtAuthenticationEntryPoint that's imported from the JwtAuthenticationEntryPoint.java file:
@Component
public class JwtAuthenticationEntryPoint implements AuthenticationEntryPoint {
@Override
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException {
response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized");
}
}If we wanted to give a specific URL redirect in response to a 403, error, we could change the SecurityConfig.java code for error handling to something like the following:
public class CustomAccessDeniedHandler implements AccessDeniedHandler {
@Override
public void handle(HttpServletRequest request, HttpServletResponse response,
AccessDeniedException accessDeniedException) throws IOException, ServletException {
response.sendRedirect("/access-denied"); // Redirect to a specific page for 403 errors
}
}This would be its own file that would be imported and added to the SecurityConfig object, as shown in the following code:
.exceptionHandling(exceptions -> exceptions
.accessDeniedHandler(new CustomAccessDeniedHandler())
.authenticationEntryPoint(jwtAuthenticationEntryPoint)
)
Toby-Leeder
raymondYsheng
Ishi-Singh
Ekamjot-Kaire
KKcbal
aidenhuynh
Accomplishments
Future plans
Goals
Pop quiz prep