Need to extend SimpleUrlAuthenticationFailureHandler

[havinhphu188]

.failureHandler(new SimpleUrlAuthenticationFailureHandler()) no longer return JSON. Instead, it return a html page.

Try a post to /api/core/login with wrong credential return a HTML instead of JSON

LemonAuthenticationFailureHandler need to be implemented

[naturalprogrammer]

We have a test case in the lemon-jpa-demo project in the source:

	@Test
	void testLoginWrongPassword() throws Exception {
		
		mvc.perform(post("/api/core/login")
                .param("username", ADMIN_EMAIL)
                .param("password", "wrong-password")
                .header("contentType",  MediaType.APPLICATION_FORM_URLENCODED))
                .andExpect(status().is(401));
	}

I tried to add .andExpect(content().string("xxx")) and the following came up in the log:

MockHttpServletResponse:
           Status = 401
    Error message = Unauthorized
          Headers = [Vary:"Origin", "Access-Control-Request-Method", "Access-Control-Request-Headers", X-Content-Type-Options:"nosniff", X-XSS-Protection:"1; mode=block", Cache-Control:"no-cache, no-store, max-age=0, must-revalidate", Pragma:"no-cache", Expires:"0", X-Frame-Options:"DENY"]
     Content type = null
             Body = 
    Forwarded URL = null
   Redirected URL = null
          Cookies = []

Above shows that body is blank, and status is 401. Hence, at first look it seems like it was nither returning JSON nor now it returns HTML.

So, when you say "no longer return JSON. Instead, it return a html page ...," do you mean it behaves differently in real environments, and previously it was returning JSON and now it retuens HTML? Could you please try it from a tool like cURL or Postman and share your findings?

[havinhphu188]

Hi @naturalprogrammer,
Here is what I am doing:

1. I am trying to demo lemon-demo-jpa project.

2. I start lemon-demo-jpa as a normal spring-boot apps

3. I found postman script inside directory "spring-lemon\lemon-demo-jpa\src\test\resources\postman" .
   

4. I import the postman scripts.

5. I found post login, with examples:

6. I assume the login failed is expecting JSON response
   

7. I try out Post login with correct credential (according to provided e.g). => success login return JSON result, as expected. Nothing to complain

8. THen, I try out Post login with false credential, it return status 401 with HTML body

P/S: Number 6 is what I assume expected behavior, according to provided Postman script. Number 9 is what I found in reality.
And when look into code, I find no implementation to extend SimpleUrlAuthenticationFailureHandler

[naturalprogrammer]

Okay, I'd try to reproduce it. BTW, it'd be very helpful if you could try from cURL, or you could try running the angularjs project (see the getting started guide for details) and test it out. I'm suspecting that, because there's no body, there is no content type, and so Postmen is defaulting to showing some HTML.

[naturalprogrammer]

Thanks for catching it, and for the elaborated input! Looks like, Spring Boot 2.4 onwards, DefaultErrorAttributes's getErrorgetError(WebRequest webRequest) returns null, which was causing null pointer exception in LexUtils.getRootException(Throwable ex). Fixed in 2307248, would be released along with 1.0.0.RC7.

[neelimaJ026832]

Hi @naturalprogrammer, Is it possible to do spring impersonation with different domain URLs? For example Admin website URL domain (which uses LDAP authentication) is different from Customer website URL domain (which uses form based authentication).

[naturalprogrammer]

Couldn't follow your question exactly. If your question is that if you could use the lemon authentication token for both websites -- should work. Unrelted to this ticket, though. Or maybe I don't understand your question. Would be nice if you could elaborate it.

[naturalprogrammer]

Fix released: https://github.com/naturalprogrammer/spring-lemon/releases/tag/1.0.1