how to use login credentials for spring app in postman?

hey guys. can smb help me out? i cant use login and password auth in postman for my spring app. i have this websecurityconfig:
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private MyUserDetailsService userDetailsService;

@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
// .antMatchers("/communicationTests").permitAll()
.antMatchers("/importBgwCurrent").permitAll()

.anyRequest().authenticated()
.and().formLogin().loginPage("/login").permitAll()
.and().logout().permitAll()
.and().csrf().disable();
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService);
auth.authenticationProvider(authProvider());
}

@Bean
public PasswordEncoder passwordEncoder() {
return new CryptEncoder();
}

@Bean
public DaoAuthenticationProvider authProvider() {
DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
authProvider.setUserDetailsService(userDetailsService);
authProvider.setPasswordEncoder(passwordEncoder());
return authProvider;
}
}
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private MyUserDetailsService userDetailsService;

@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
// .antMatchers("/communicationTests").permitAll()
.antMatchers("/importBgwCurrent").permitAll()

.anyRequest().authenticated()
.and().formLogin().loginPage("/login").permitAll()
.and().logout().permitAll()
.and().csrf().disable();
}

@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService);
auth.authenticationProvider(authProvider());
}

@Bean
public PasswordEncoder passwordEncoder() {
return new CryptEncoder();
}

@Bean
public DaoAuthenticationProvider authProvider() {
DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
authProvider.setUserDetailsService(userDetailsService);
authProvider.setPasswordEncoder(passwordEncoder());
return authProvider;
}
}
if i disable permitAll, then i select basic auth in postman, enter my username us3rnam3 and pa55word, but in the response i still get login page html. but if i have permitAll disabled and go to my endpoint with browser, i get login page, enter credentials and everything works fine. if i enable permitAll, then everything is fine in postman and browser too. can smb explain what im doing wrong? thanks
98 Replies
JavaBot
JavaBot16mo ago
This post has been reserved for your question.
Hey @bambyzas! Please use /close or the Close Post button above when your problem is solved. Please remember to follow the help guidelines. This post will be automatically closed after 300 minutes of inactivity.
TIP: Narrow down your issue to simple and precise questions to maximize the chance that others will reply in here.
Unknown User
Unknown User16mo ago
Message Not Public
Sign In & Join Server To View
bambizas19
bambizas19OP16mo ago
its not my code, but thanks ill fix it
Unknown User
Unknown User16mo ago
Message Not Public
Sign In & Join Server To View
bambizas19
bambizas19OP16mo ago
if im using login and pass in the browser, why cant postman use it too?
Unknown User
Unknown User16mo ago
Message Not Public
Sign In & Join Server To View
bambizas19
bambizas19OP16mo ago
ok, but i want to do it
Unknown User
Unknown User16mo ago
Message Not Public
Sign In & Join Server To View
bambizas19
bambizas19OP16mo ago
if u dont know how to help, then dont waste our time and just say it
Unknown User
Unknown User16mo ago
Message Not Public
Sign In & Join Server To View
bambizas19
bambizas19OP16mo ago
thats not what i asked
Unknown User
Unknown User16mo ago
Message Not Public
Sign In & Join Server To View
bambizas19
bambizas19OP16mo ago
im not using bearer token lol
Unknown User
Unknown User16mo ago
Message Not Public
Sign In & Join Server To View
bambizas19
bambizas19OP16mo ago
im not using any token lol im using login and password whats ur problem
Rag...JN 🌌 🦡 👽 💰 🐊
ChatGPT response?
No description
bambizas19
bambizas19OP16mo ago
thats not what i asked
Rag...JN 🌌 🦡 👽 💰 🐊
that's what u asked can't login in Postman when disabled permitAll
bambizas19
bambizas19OP16mo ago
yes and idk how to send proper request with postman all the answers on google are talking about some kind of token, when im not using it thats why i asked here
Rag...JN 🌌 🦡 👽 💰 🐊
csrf token right?
bambizas19
bambizas19OP16mo ago
no idea. csrf token, bearer token, cookie while im just sending my username and password
Rag...JN 🌌 🦡 👽 💰 🐊
but in your code you have disabled csrf token check
bambizas19
bambizas19OP16mo ago
idk what it is and why should i do smth about it. sorry
Rag...JN 🌌 🦡 👽 💰 🐊
I asked Peter maybe he can sort it out
Peter Rader
Peter Rader16mo ago
Hm, csrf is disabled afaik.
Rag...JN 🌌 🦡 👽 💰 🐊
also permit all means you give permissions regardless of the authentication right?
Peter Rader
Peter Rader16mo ago
Is a session-cookie set due to the requests?
Rag...JN 🌌 🦡 👽 💰 🐊
No he didn't set any
Peter Rader
Peter Rader16mo ago
@bambyzas Could you please check if the servers response (no matter if successful or not) return a cookie to the postman? Should look like "Set-Cookie: xxxx" Yes, well at least to the spring-security-layer, there might be some other magic in the app directly.
bambizas19
bambizas19OP16mo ago
idk man. here it says theres no cookie (whatever that means), but in cookies scetion theres a cookie
No description
bambizas19
bambizas19OP16mo ago
No description
Peter Rader
Peter Rader16mo ago
Ok, we have a session cookie. Thanks. You posted code. In the code a permitAll is disabled throu comment markers //. Is it the permitAll you are enabling/disabling?
bambizas19
bambizas19OP16mo ago
i dont understand whats the deal with permitAll all of you are talking about. but yeah. i just disable/enable this .antMatchers("/communicationTests").permitAll()
Peter Rader
Peter Rader16mo ago
Ok, now I understand the problem. Let me think...
bambizas19
bambizas19OP16mo ago
i just dont understand how to make a proper auth req with postman thats it
Peter Rader
Peter Rader16mo ago
Long story short, do you like to enable the deprecated BasicAuth mechanism for authentication?
bambizas19
bambizas19OP16mo ago
um, idk tbh. i want to use the same mechanism my browser successfully uses
Peter Rader
Peter Rader16mo ago
Usually if you can set session-cookies you should avoid basicAuth. Unfortunately this will make the postman-test more complicated.
bambizas19
bambizas19OP16mo ago
again, why cant i just send my username and password like my browser does? why do i have to go through all this unnecessary stuff? :/ cookies, tokens, etc
Peter Rader
Peter Rader16mo ago
Your browser does two requests. 1. Authentication 2. /communicationTests This means your postman must send two requests too.
bambizas19
bambizas19OP16mo ago
ohhh
Peter Rader
Peter Rader16mo ago
Both requests are connected by the jsession-cookie.
bambizas19
bambizas19OP16mo ago
now its starting to make sense
Peter Rader
Peter Rader16mo ago
Unfortunately there are many authentication methods. BasicAuth is older than the Cookie technology.
bambizas19
bambizas19OP16mo ago
okay. but how do i know what auth meth is used?
Peter Rader
Peter Rader16mo ago
You said the app is working fine in the browser. Since you are not using basic-auth in the browser, you are definitievly using the jsession-cookie! The jsession-cookie has an unique identifier in the browser-tab, the jsession-cookie-code and the Webapp remember that this jsession-cookie-code has been authenticated. This is why your authentication survive the second request. In postman you need to have two requests. The first request is the request to /login sending the correct credentials. Then the first request in postman will give you a jsession-cookie having the jsession-cookie-code. You need to use that code in the second request as the session-cookie (I think postman has a special field for the cookie). To copy the jsession-cookie-code from the browser (using the inspection-tools by the F12 key) to use it in postman Might Work! But spring might notice that the Agent of the Browser is "Chrome" but the Agent of Postman is "Postman". Spring might reject the second request from a different client.
bambizas19
bambizas19OP16mo ago
okay. but in the headers i dont have a cookie
No description
Peter Rader
Peter Rader16mo ago
You are showing the response-headers. You need to submit the jsession-cookie-code in the request-headers.
bambizas19
bambizas19OP16mo ago
im telling u that i dont receive the cookie, and ur telling me that i need to submit it
Peter Rader
Peter Rader16mo ago
Ah ok, I thought you already have a authenticated cookie-code. My bad. But the header is there! Unfortunately Postman does not list it. Postman mention the header in the tab "Cookies". But trustme, the cookie is a header.
bambizas19
bambizas19OP16mo ago
u r talking about this one, right?
No description
Peter Rader
Peter Rader16mo ago
Yes. This is the jsession-cookie-code.
bambizas19
bambizas19OP16mo ago
ah ok
Peter Rader
Peter Rader16mo ago
This jsession-cookie is not authenticated.
bambizas19
bambizas19OP16mo ago
wait, so i need to do smth before doing second req?
Peter Rader
Peter Rader16mo ago
Yes, you need to send the credentials using postman. Then you will get a jsession-cookie that is authenticated.
bambizas19
bambizas19OP16mo ago
or can i start filling the needed fields for my 2nd req? oh, so i can start constructing my 2nd req
Peter Rader
Peter Rader16mo ago
Your screenshot is your second request.
bambizas19
bambizas19OP16mo ago
i still get the same error
bambizas19
bambizas19OP16mo ago
No description
Peter Rader
Peter Rader16mo ago
This is a different error. Right, this error sais "Your credentials are wrong." "You are not authenticated" != "Your credentails are wrong."
bambizas19
bambizas19OP16mo ago
i know, but these creds work in browser
Peter Rader
Peter Rader16mo ago
Please show the post-body of your postman-login-attempt.
Rag...JN 🌌 🦡 👽 💰 🐊
show the credentials
bambizas19
bambizas19OP16mo ago
No description
Rag...JN 🌌 🦡 👽 💰 🐊
check form-data and raw
bambizas19
bambizas19OP16mo ago
wdym i didnt send any creds?
No description
Peter Rader
Peter Rader16mo ago
This is basic-auth. As I said, basic-auth is disabled. You need to authenticate using jsession-cookie.
bambizas19
bambizas19OP16mo ago
im doing it
No description
Rag...JN 🌌 🦡 👽 💰 🐊
Auth Type needs to be changed is what he said
Peter Rader
Peter Rader16mo ago
Please show the contents of
No description
bambizas19
bambizas19OP16mo ago
No description
Peter Rader
Peter Rader16mo ago
Spring will compleatly Ignore the basic-auth for security reasons. Ok, you do send no login and no password to the jsession-cookie. Basic auth is ignored because it is old, unsafe, obsolete and deprecated
bambizas19
bambizas19OP16mo ago
got it
Rag...JN 🌌 🦡 👽 💰 🐊
it should look like this
No description
Peter Rader
Peter Rader16mo ago
👍🏻
bambizas19
bambizas19OP16mo ago
thanks, ffs it finally works
No description
Peter Rader
Peter Rader16mo ago
You ROCK!
Rag...JN 🌌 🦡 👽 💰 🐊
thank Peter Rader
Peter Rader
Peter Rader16mo ago
No thank you mate! We are not done yet!
bambizas19
bambizas19OP16mo ago
i guess ill need to take notes on this stuff, because i was losing my mind over this. thanks for ur patience guys really? is there smth more to it?
Peter Rader
Peter Rader16mo ago
Step 1 is finished. Now you have your authenticated jsession-cookie-code. You need to use that code in the request-Header "Cookie" for the second post-request against /communicationTest.
bambizas19
bambizas19OP16mo ago
but when ill be hitting /communicationTest, ill just need to send cookie, or do i need to include the creds? as i understand it, now i kinda "established the connection" so i dont need to send creds, right?
Peter Rader
Peter Rader16mo ago
The jsession-cookie-code is your credential from now on! Sometimes those jsession-cookies are too old and will not be valid because the server think the user has left his PC to go home and forgot to logout. Absolutly, you have established the authenticated connection using the jsession-cookie-code. As I said, you need to send a post-request-header having the name "Cookie" and the value of the code to the /communicationTest url.
bambizas19
bambizas19OP16mo ago
almost empty req, right? only Cookie header with its val? no body and nothing set in Authorization section
bambizas19
bambizas19OP16mo ago
No description
bambizas19
bambizas19OP16mo ago
ah, crap, POST isnt supported haha GET works
bambizas19
bambizas19OP16mo ago
thanks
Peter Rader
Peter Rader16mo ago
Lets celebrate!
JavaBot
JavaBot16mo ago
If you are finished with your post, please close it. If you are not, please ignore this message. Note that you will not be able to send further messages here after this post have been closed but you will be able to create new posts.
Peter Rader
Peter Rader16mo ago
You guys rock!
bambizas19
bambizas19OP16mo ago
thanks for explaining everything step by step
Peter Rader
Peter Rader16mo ago
MDN Web Docs
Using HTTP cookies - HTTP | MDN
A cookie (also known as a web cookie or browser cookie) is a small piece of data a server sends to a user's web browser. The browser may store cookies, create new cookies, modify existing ones, and send them back to the same server with later requests. Cookies enable web applications to store limited amounts of data and remember state informatio...
Unknown User
Unknown User16mo ago
Message Not Public
Sign In & Join Server To View
Peter Rader
Peter Rader16mo ago
I do not know either. I reat what you wrote and everything you wrote is correct. Maybe I reflect the emotions better. I tried to act like a wingman, contribute and support to his anger. Feel him deep inside 😛
JavaBot
JavaBot7mo ago
💤 Post marked as dormant
This post has been inactive for over 300 minutes, thus, it has been archived. If your question was not answered yet, feel free to re-open this post or create a new one. In case your post is not getting any attention, you can try to use /help ping. Warning: abusing this will result in moderative actions taken against you.
💤 Post marked as dormant
This post has been inactive for over 300 minutes, thus, it has been archived. If your question was not answered yet, feel free to re-open this post or create a new one. In case your post is not getting any attention, you can try to use /help ping. Warning: abusing this will result in moderative actions taken against you.

Did you find this page helpful?