Spring Security Access Denied会产生HTTP 405

Question

I have a spring web app that using customized AccessDecisionVoter. This customized decision voter will find the required permission to access a URL, and then check if the login user have granted the required permission.

If the login user don't have the required permission granted, then this customized decision voter shall return ACCESS_DENIED, otherwise it shall return ACCESS_GRANTED.

The problem now is: when a user try to access the a URL that he don't have permission granted, the app server a HTTP 405. Note that when user access the URL via GET method (eg enter the URL into browser address bar), he will get HTTP 403. The HTTP 405 occur only only POST method. Take note that my spring-mvc controller doesn't restrict the HTTP method.

I confirm that the decision voter is returning ACCESS_DENIED (-1), based on my log file. Somehow my browser just received a HTTP 405.

I am using spring-security 5.0.1

Below are my codes:

my customized decision voter:

@Override
public int vote(Authentication authentication, Object object, Collection securityConfigs) {
    logger.debug("Authorization in progress");
    if (authentication == null) {
        logger.info("No authentication. Access Denied.");
        return ACCESS_DENIED;
    }

    if (securityConfigs.size() == 0) {
        logger.info("No matching Page Config found for the given URL. Access Denied.");
        return ACCESS_DENIED;
    }

    int result = ACCESS_ABSTAIN;
    Set<String> authorities = extractAuthorities(authentication);

    String username = authentication.getName().toUpperCase();
    logger.debug("authentication.getName() = " + username);

    for (Object configObject : securityConfigs) {
        SecurityConfig config = (SecurityConfig) configObject;
        if (this.supports(config.getAttribute())) {
            result = ACCESS_DENIED;
            String attributeUpperCase = config.getAttribute().toUpperCase();
            logger.debug("config attribute = " + attributeUpperCase);

            if (authorities.contains(attributeUpperCase)) {
                logger.info("The request url has config attribute that matches the login user's granted Master Function Code. Access Granted. The matching config attribute = " + attributeUpperCase);
                return ACCESS_GRANTED;
            }
        }
    }

    logger.info("Voting Result from DaxVoter = " + result);

    return result;
}

My Controller:

@ResponseBody
@RequestMapping(value ="/road/retrieveRoad.do")
public Map<String, Object> retrieveRoad(HttpServletRequest request, @RequestBody DataParamsBean dataParams) {
    logger.info("CommonSupportCtrl | retrieveRoad | Start"); 
    Map<String, Object> resultMap = new HashMap<String, Object>();

    int start = dataParams.getSkip();
    int limit = (dataParams.getTake() == 0) ? 10 : (int) dataParams.getTake();
    String sortBy = (dataParams.getSorted() == null) ? null : (String) dataParams.getSorted().get(0).get("name");
    String sortDirection = (dataParams.getSorted() == null) ? null : (String) dataParams.getSorted().get(0).get("direction");
    String roadCode = dataParams.getParams().get("id") == null ? null : (String) dataParams.getParams().get("id");
    String roadName = dataParams.getParams().get("roadName") == null ? null : (String) dataParams.getParams().get("roadName");

    if(sortDirection != null) {
        if(sortDirection.equalsIgnoreCase("ascending")) {
            sortDirection = "asc";
        } else {
            sortDirection = "desc";
        }
    }

    GenericSearchResults<RoadBean> searchResults = commonSupportService.retrieveRoadByCriteria(roadName, roadCode, start, limit,
            sortBy, sortDirection);

    resultMap.put("result", searchResults.getResult());
    resultMap.put("count", searchResults.getCount());

    logger.info("CommonSupportCtrl | retrieveRoad | End"); 
    return resultMap;
}

Answer 1

I managed to resolved it. Its actually due to the that I have configured in the web.xml. I resolve it by changing my error pages from .htm to .jsp instead, just changing the file format, without changing the content at all. So I assume the .htm just can NOT support POST method, while the .jsp can.