十二运女子排球16-19岁组比赛新闻发布会举行

Question

I have a Spring Boot project and am using Firebase Auth with Spring Security.

I am also configuring Swagger for API documentation. My code is:

package com.ayushsingh.doc_helper.commons.config.security;

import java.time.Instant;

import com.ayushsingh.doc_helper.commons.constants.AuthConstants;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import jakarta.servlet.http.HttpServletResponse;

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(prePostEnabled = true)
public class SecurityConfig {

    private final FirebaseAuthFilter firebaseAuthFilter;
    private final FirebaseAuthenticationProvider firebaseAuthenticationProvider;

    public SecurityConfig(FirebaseAuthFilter firebaseAuthFilter,
                          FirebaseAuthenticationProvider firebaseAuthenticationProvider) {
        this.firebaseAuthFilter = firebaseAuthFilter;
        this.firebaseAuthenticationProvider = firebaseAuthenticationProvider;
    }

    @Bean
    public SecurityFilterChain apiFilterChain(HttpSecurity http) throws Exception {
        http
                .csrf(AbstractHttpConfigurer::disable)
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers(AuthConstants.AUTH_API_PATTERN,
                                "/swagger-ui/**",
                                "/swagger-ui.html",
                                "/webjars/**",
                                "/configuration/security",
                                "/swagger-resources/**",
                                "/swagger-resources",
                                "/v3/api-docs/**",
                                "/v3/api-docs"
                                )
                        .permitAll()
                        .anyRequest().authenticated())
                .authenticationProvider(firebaseAuthenticationProvider)
                .addFilterBefore(firebaseAuthFilter, UsernamePasswordAuthenticationFilter.class)
                .exceptionHandling(ex -> ex
                        .authenticationEntryPoint(firebaseAuthenticationEntryPoint())
                        .accessDeniedHandler(accessDeniedHandler()));

        return http.build();
    }

    @Bean
    public AuthenticationEntryPoint firebaseAuthenticationEntryPoint() {
        return (request, response, authException) -> {
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            response.setContentType("application/json");
            response.setCharacterEncoding("UTF-8");

            String jsonResponse = """
                    {
                        "success": false,
                        "error": {
                            "code": "UNAUTHORIZED",
                            "message": "Authentication required. Please provide a valid Firebase token.",
                            "timestamp": "%s"
                        }
                    }
                    """.formatted(Instant.now());

            response.getWriter().write(jsonResponse);
        };
    }

    @Bean
    public AccessDeniedHandler accessDeniedHandler() {
        return (request, response, accessDeniedException) -> {
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response.setContentType("application/json");
            response.setCharacterEncoding("UTF-8");

            String jsonResponse = """
                    {
                        "success": false,
                        "error": {
                            "code": "FORBIDDEN",
                            "message": "Insufficient privileges to access this resource.",
                            "timestamp": "%s"
                        }
                    }
                    """.formatted(Instant.now());

            response.getWriter().write(jsonResponse);
        };
    }
}

I have also created a AuthFilter for Firebase-

package com.ayushsingh.doc_helper.commons.config.security;

import java.io.IOException;

import com.ayushsingh.doc_helper.commons.constants.AuthConstants;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import com.ayushsingh.doc_helper.features.auth.domain.AuthUser;
import com.ayushsingh.doc_helper.features.user.domain.User;
import com.ayushsingh.doc_helper.features.user.service.UserService;
import com.google.firebase.auth.FirebaseAuth;
import com.google.firebase.auth.FirebaseAuthException;
import com.google.firebase.auth.FirebaseToken;

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import lombok.extern.slf4j.Slf4j;

@Component
@Slf4j
public class FirebaseAuthFilter extends OncePerRequestFilter {

    private final FirebaseAuth firebaseAuth;
    private final UserService userService;

    public FirebaseAuthFilter(FirebaseAuth firebaseAuth, UserService userService) {
        this.firebaseAuth = firebaseAuth;
        this.userService = userService;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request,
            HttpServletResponse response,
            FilterChain filterChain) throws ServletException, IOException {

        String token = getTokenFromRequest(request);

        if (token != null) {
            try {
                FirebaseToken decodedToken = firebaseAuth.verifyIdToken(token);
                String firebaseUid = decodedToken.getUid();
                User user = userService.findByFirebaseUid(firebaseUid);

                if (user != null) {
                    AuthUser authUser = new AuthUser(user);
                    FirebaseAuthenticationToken authentication = new FirebaseAuthenticationToken(authUser,
                            authUser.getAuthorities());
                    SecurityContextHolder.getContext().setAuthentication(authentication);
                } else {
                    log.warn("User not found for Firebase UID: {}", firebaseUid);
                    SecurityContextHolder.clearContext();
                }
            } catch (FirebaseAuthException e) {
                log.error("Firebase token verification failed: {}", e.getMessage());
                SecurityContextHolder.clearContext();
            }
        }

        filterChain.doFilter(request, response);
    }

    private String getTokenFromRequest(HttpServletRequest request) {
        String bearerToken = request.getHeader(AuthConstants.AUTHORIZATION_HEADER);
        if (bearerToken != null && bearerToken.startsWith(AuthConstants.BEARER)) {
            return bearerToken.substring(7);
        }
        return null;
    }

    @Override
    protected boolean shouldNotFilter(HttpServletRequest request) {
        String path = request.getServletPath();
        String method = request.getMethod();

        // Skip filter for public endpoints
        var skipFilter = (path.startsWith(AuthConstants.AUTH_API_PREFIX) && "POST".equals(method))
                || path.startsWith("/api/auth/")
                || path.startsWith("/swagger-ui")
                || path.startsWith("/swagger-resources")
                || path.startsWith("/v3/api-docs")
                || path.startsWith("/webjars")
                || path.equals("/swagger-ui.html")
                || path.endsWith(".js")
                || path.endsWith(".css")
                || path.endsWith(".html")
                || path.endsWith(".png")
                || path.endsWith(".ico")
                || path.endsWith(".map");

        System.out.println("Skip filter: " + skipFilter+" request: "+request.getRequestURI());
        return skipFilter;
    }
}

When I hit any of the swagger endpoint, I get the response:

{
  "success": false,
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Authentication required. Please provide a valid Firebase token.",
    "timestamp": "2025-08-05T06:12:36.329330400Z"
  }
}

I checked my public endpoint config using a /test endpoint and it works fine, but I am unable to access the swagger endpoints.

Please don't post screenshots of textual output, post it at code-formatted text (marked as json for syntax highlighting). — Mark Rotteveel, Commented Aug 2 at 8:54
What is the URL you tried with your request? As an aside, I think those endsWith conditions will clash with your Spring Security filtering. — Mark Rotteveel, Commented Aug 2 at 8:59

Radioactive · Accepted Answer · 2025-08-05 15:17:50Z

The list of endpoints in shouldNotFilter is incomplete and does not perfectly match the configuration in SecurityConfig. For instance, it is missing paths like /configuration/security, which are required for Swagger UI to function correctly.

When a request for such a path is made, shouldNotFilter returns false, causing your filter to run. Since the request to a Swagger endpoint does not contain an authentication token, your filter does nothing to the security context.

However, the request is then processed by Spring Security's filter chain, which ultimately denies access because it's treated as an unauthenticated request to a protected resource, triggering your firebaseAuthenticationEntryPoint.

agilgur5 · Accepted Answer · 2025-08-05 04:28:58Z

I ran into the same issue recently and managed to fix it.

The problem seems to be that Spring Security was still hitting the FirebaseAuthFilter for Swagger paths OR the paths in .requestMatchers(...) and shouldNotFilter() don’t exactly match the incoming request URI

Here’s what worked for me:

1. I updated shouldNotFilter() method in AuthFilter to match full Swagger paths correctly like this

@Override
protected boolean shouldNotFilter(HttpServletRequest request) {
    String path = request.getServletPath();
    return path.startsWith("/swagger-ui")
            || path.startsWith("/swagger-resources")
            || path.startsWith("/v3/api-docs")
            || path.startsWith("/webjars/")
            || path.equals("/swagger-ui.html")
            || path.endsWith(".js")
            || path.endsWith(".css")
            || path.endsWith(".html")
            || path.endsWith(".png")
            || path.endsWith(".ico")
            || path.endsWith(".map")
            || path.startsWith("/api/auth/") // your auth prefix
            || (path.startsWith("/api/public/"));

2. I also made sure that SecurityConfig has exact matches like this:

.requestMatchers(   
    "/swagger-ui/\*\*",
    "/swagger-ui.html",
    "/webjars/\*\*",
    "/configuration/security",
    "/swagger-resources/\*\*",
    "/v3/api-docs/\*\*",
    "/v3/api-docs"
).permitAll()

3. After these fixes, rebuild the project

4. Restart the server

5. Open Swagger at: http://localhost:8080/swagger-ui/index.html

Pro Tip: Use AntPathRequestMatcher for cleaner code instead of string matching.

I hope this helps.

pvs是什么意思	老年人吃什么	嘴角起泡用什么药膏好	人什么地灵	睚眦是什么意思
龙井属于什么茶	乙肝二四五阳性什么意思	丹宁蓝是什么颜色	泰迪哼哼唧唧表示什么	梦见刀是什么意思
nars属于什么档次	什么叫盗汗	中秋节什么时候	david是什么意思	手上脱皮是什么原因
男人结扎有什么危害	叶酸在什么食物里最多	翩跹是什么意思	白细胞偏高有什么危害	右脸长痣代表什么意思

狮子男和什么星座最配wuhaiwuya.com	wonderful什么意思hcv8jop0ns5r.cn	宫内膜回声不均匀是什么意思hcv7jop5ns2r.cn	眉毛上长痘是什么原因naasee.com	迁徙是什么意思hcv9jop1ns3r.cn
纤维素纤维是什么面料hcv8jop9ns2r.cn	为什么男人喜欢邓文迪hcv8jop1ns1r.cn	睡觉开风扇有什么危害hcv8jop9ns8r.cn	单从属于什么茶hcv8jop6ns6r.cn	头痛是什么原因hcv8jop6ns5r.cn
阴蒂长什么样hcv8jop0ns4r.cn	脂肪肝浸润是什么意思hcv8jop5ns3r.cn	食管裂孔疝是什么原因造成的clwhiglsz.com	女人手心热吃什么调理hcv8jop1ns7r.cn	检查肺部最好做什么检查jingluanji.com
沦丧是什么意思bjhyzcsm.com	枕神经痛吃什么药wmyky.com	日本天皇叫什么名字hcv9jop0ns9r.cn	乳液是什么hcv8jop1ns4r.cn	情是什么意思hcv8jop5ns7r.cn

Collectives? on Stack Overflow

十二运女子排球16-19岁组比赛新闻发布会举行

2 Answers 2

Your Answer

Hot Network Questions

Collectives? on Stack Overflow

十二运女子排球16-19岁组比赛新闻发布会举行

2 Answers 2

Your Answer

Sign up or log in

Post as a guest

Related

Hot Network Questions