403 Forbbiden: Pre-authenticated entry point called. Rejecting access – Java

The Problem:

The stack trace shows a 403 Forbidden error with the message: "Pre-authenticated entry point called. Rejecting access." This error occurs when using Spring Security and is typically caused by an issue with the pre-authentication configuration. Specifically, the error indicates that the pre-authentication entry point was called, but access was rejected.

In this case, it appears that the user is authenticated and has the correct role, but the request is still being rejected. This suggests that there may be an issue with the authorization configuration or implementation.

To resolve this issue, check the configuration of the authorization filter chain and ensure that the correct roles and permissions are assigned to the endpoint. Additionally, verify that there are no custom filters or interceptors that could be interfering with the authorization process and causing the request to be rejected.

The Solutions:

Solution 1: Adjusted CSRF Configuration

In your security configuration, you should explicitly disable CSRF protection for the endpoint /api/v1/client/findAllUsersByRole. This is because Spring Security enables CSRF protection by default, which can interfere with pre-authenticated endpoints.

To disable CSRF protection for this endpoint, add the following line after the anyRequest().authenticated() line in your security configuration:

.csrf().ignoringRequestMatchers("/api/v1/client/findAllUsersByRole")

This will allow the endpoint to be accessed without requiring a CSRF token.

Here’s the updated security configuration:

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfiguration {

    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        return http
                .authorizeHttpRequests(auth -> {
                    auth.requestMatchers("/api/v1/client/createUser").permitAll();
                    auth.requestMatchers("/api/v1/client/home").permitAll();
                    auth.anyRequest().authenticated();
                })
                .csrf(csrf -> {
                    csrf.ignoringRequestMatchers("/api/v1/client/createUser", "/api/v1/client/home", "/api/v1/client/findAllUsersByRole");
                })
                .oauth2Login(withDefaults())
                .formLogin(withDefaults())
                .build();
    }

}

Once you make this change, the endpoint should be accessible without the "403 Forbidden: Pre-authenticated entry point called. Rejecting access" error.

Video Explanation:

The following video, titled "How to fix Unexpected Token in JSON error (for web developers ...", provides additional insights and in-depth exploration related to the topics discussed in this post.

... error in your code? Unhandled Rejection (SyntaxError): Unexpected token in JSON at position 0 The position and the character may vary, but ...