Redirect to Login page or give 403 error based on requested URL

Question

I have an app made with Spring boot using security. This app use MVC to show some pages and also use some rest interfaces for update/get objects.

Right now, every request I make without being logged in, i'm redirected to the /login page.

That's working as intented when I try to access from the web browser. But I want the app to react different when I try to access some particular path from the page, for example "/api/customers".

If I try to access to that path, I want to drop HTTP 403 error, not redirect to the login page.

This is my Security configuration:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.headers()
            .referrerPolicy(ReferrerPolicyHeaderWriter.ReferrerPolicy.SAME_ORIGIN);

    http.authorizeRequests()
            .antMatchers("/js/**", "/img/**")
            .permitAll()
            .antMatchers("/**").authenticated()
            .and()
            .csrf().disable()
            .formLogin()
            .loginPage("/login")
            .usernameParameter("email")
            .passwordParameter("password")
            .and()
            .logout()
            .logoutUrl("/logout")
            .logoutSuccessUrl("/login?logged-out")
            .and()
            .exceptionHandling()
            .accessDeniedPage("/access-denied")

    ;
}

Is this posible?

Answer 1

You can create a custom AuthenticationEntryPoint:

https://docs.spring.io/spring-security/site/docs/4.0.4.RELEASE/reference/htmlsingle/#auth-entry-point

The AuthenticationEntryPoint will be called if the user requests a secure HTTP resource but they are not authenticated. An appropriate AuthenticationException or AccessDeniedException will be thrown by a security interceptor further down the call stack, triggering the commence method on the entry point. This does the job of presenting the appropriate response to the user so that authentication can begin.

@Component
public class Http401UnauthorizedEntryPoint implements AuthenticationEntryPoint {

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response, 
                               AuthenticationException ex)
            throws IOException, ServletException {

        boolean somePath = request.getServletPath().equals("/somePath");

        if(somePath){
            response.sendError(SC_FORBIDDEN, "Access Denied");
        }
        else{
            response.sendRedirect("/login");
        }
    }
}

and register it with the Framework:

http.exceptionHandling().authenticationEntryPoint(authenticationEntryPoint)

Answer 2

Spring Security has a DelegatingAuthenticationEntryPoint that allows selection of a concrete AuthenticationEntryPoint based on a RequestMatcher evaluation.

https://docs.spring.io/spring-security/site/docs/5.7.x/api/org/springframework/security/web/authentication/DelegatingAuthenticationEntryPoint.html