spring-guides / tut-spring-security-and-angular-js

Spring Security and Angular:: A tutorial on how to use Spring Security with a single page application with various backend architectures, ranging from a simple single server to an API gateway with OAuth2 authentication.

Home Page:https://spring.io/guides/tutorials/spring-security-and-angular-js/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

URL rewriting required in gateway / ui / resource example ?

ddewaele opened this issue · comments

I was trying the samples In the double folder, executing the seperate gateway / ui / resource apps (via mvn spring-boot:run).

As per my understanding, the UI now needs to be accessed via the gateway on http://localhost:8080/ui

However I'm getting a blank screen and the following error in my console

Error parsing header X-XSS-Protection: 1; mode=block, 1; mode=block: expected semicolon at character position 14. The default protections will be applied.
ui:7 GET http://localhost:8080/css/angular-bootstrap.css 
ui:36 GET http://localhost:8080/js/angular-bootstrap.js 
ui:37 GET http://localhost:8080/js/hello.js 

It seems that the page is trying to load the JS resources from the root context (/) on the gatway. (this works fine when the ui is accessed directly, as then it is loaded from the root context of the UI app, but it doesn't work when accessed via the gateway).

Am I missing some configuration / code to do the rewriting of those resources ?

The tutorial also mentions putting security.sessions: NEVER in the application config but I'm not seeing that in the application.yml

I think you need the trailing slash (as per the link in the main index.html), i.e. http://localhost:8080/ui/.

It was indeed the trailing slash. Thx for that.

Regarding the security.sessions: NEVER, was this omitted from the ui module for a specific reason ?

I think it's the default for the standard Boot autoconfigured security, so it isn't necessary unless you add your own security configuration.

Perfect. Thx.