SpringMVC Websockets Messaging User Authentication with Spring Security

深藏阁楼爱情的钟 2022-08-13 12:36 20阅读 0赞

<table> 
 <tbody> 
 <tr> 
 <td> 
 <div> 
 <a title="This question shows research effort; it is useful and clear" rel="nofollow"></a> 
 1 
 <a title="This question does not show any research effort; it is unclear or not useful" rel="nofollow">down vote</a> 
 <a title="This is a favorite question (click again to undo)" href="http://stackoverflow.com/questions/25004081/springmvc-websockets-messaging-user-authentication-with-spring-security#" rel="nofollow">favorite</a> 
 <div> 
 1 
 </div> 
 </div> </td> 
 <td> 
 <div> 
 <div> 
 I have seen a couple of threads about this issue, but none of them seem to really answer the question directly. 
 Background, I have spring security installed, working, and running smoothly in other parts of the application. My username is "developer". 
 Running on Java 7, Glassfish 4, Spring 4, and using Angular + StompJS 
 Let's get some code here: 
 <pre><code><code>package com.myapp.config; import org.springframework.context.annotation.Configuration; import org.springframework.messaging.simp.config.MessageBrokerRegistry; import org.springframework.web.socket.config.annotation.AbstractWebSocketMessageBrokerConfigurer; import org.springframework.web.socket.config.annotation.EnableWebSocketMessageBroker; import org.springframework.web.socket.config.annotation.StompEndpointRegistry; @Configuration @EnableWebSocketMessageBroker public class WebSocketBrokerConfig extends AbstractWebSocketMessageBrokerConfigurer { public final static String userDestinationPrefix = "/user/"; @Override public void registerStompEndpoints(StompEndpointRegistry registry) { registry.addEndpoint("/stomp").withSockJS().setSessionCookieNeeded(true); } @Override public void configureMessageBroker(MessageBrokerRegistry registry) { registry.setApplicationDestinationPrefixes("/app"); //registry.enableStompBrokerRelay("/topic,/user"); registry.enableSimpleBroker("/topic", "/user"); registry.setUserDestinationPrefix(userDestinationPrefix); } }</code></code></pre> 
 Ok, now here is a controller, to send out stuff every 3 seconds: 
 <pre><code><code>import org.springframework.messaging.simp.SimpMessagingTemplate; … @Autowired private SimpMessagingTemplate messagingTemplate; … @Scheduled(fixedDelay = 3000) public void sendStuff () { Map&lt;String, Object&gt; map = new HashMap&lt;&gt;(); map.put(MessageHeaders.CONTENT_TYPE, MimeTypeUtils.APPLICATION_JSON); System.out.print("Sending data! " + System.currentTimeMillis()); //messagingTemplate.convertAndSend("/topic/notify", "Public: " + System.currentTimeMillis()); messagingTemplate.convertAndSendToUser("developer", "/notify", "User: " + System.currentTimeMillis()); messagingTemplate.convertAndSendToUser("notYou", "/notify", "Mr Developer Should Not See This: " + System.currentTimeMillis()); }</code></code></pre> 
 And finally the JavaScript using SockJS 
 <pre><code><code> var client = new SockJS('/stomp'); var stomp = Stomp.over(client); stomp.connect({}, function(s) { //This should work stomp.subscribe('/user/' + s.headers['user-name'] + '/notify', console.debug); //This SHOULD NOT stomp.subscribe('/user/notYou/notify', console.debug); }); client.onclose = $scope.reconnect;</code></code></pre> 
 And finally, for kicks, the pom.xml 
 <pre><code><code> &lt;dependency&gt; &lt;groupId&gt;javax.websocket&lt;/groupId&gt; &lt;artifactId&gt;javax.websocket-api&lt;/artifactId&gt; &lt;version&gt;1.0&lt;/version&gt; &lt;/dependency&gt; &lt;dependency&gt; &lt;groupId&gt;org.springframework&lt;/groupId&gt; &lt;artifactId&gt;spring-messaging&lt;/artifactId&gt; &lt;version&gt;4.0.6.RELEASE&lt;/version&gt; &lt;/dependency&gt; &lt;dependency&gt; &lt;groupId&gt;org.springframework&lt;/groupId&gt; &lt;artifactId&gt;spring-websocket&lt;/artifactId&gt; &lt;version&gt;4.0.6.RELEASE&lt;/version&gt; &lt;/dependency&gt;</code></code></pre> 
 Here is what does work: 
 <ol> 
 <li>I can produce wonderfully communication back and forth between the client and the server</li> 
 <li>It's fast</li> 
 <li><code>messagingTemplate.convertAndSend</code> and <code>messagingTemplate.convertAndSendToUser</code></li> 
 </ol> 
 This is the problem (noted above): Anyone can subscribe to other users feeds. 
 Now, there are a few other versions of this floating around, I will list them below, and explain why the answers are all wrong: 
 <a href="http://stackoverflow.com/questions/16266775/what-are-the-security-issues-around-an-open-websocket-connection" rel="nofollow">What are the security issues around an open websocket connection?</a> 
 <a href="http://stackoverflow.com/questions/23778451/spring-websocket-with-stomp-security-every-user-can-subscribe-to-any-other-use/24912974#comment38877147_24912974" rel="nofollow">Spring websocket with stomp security - every user can subscribe to any other users queue?</a> 
 <a href="http://stackoverflow.com/questions/24282138/websocket-how-to-push-a-message-to-a-target-user/24912748#comment38877178_24912748" rel="nofollow">Websocket: How To Push A Message To A Target User</a> 
 Here's the problem: 
 <ul> 
 <li> Look at <code>messagingTemplate.convertAndSendToUser</code> - All that does is add the "user prefix" and then the username provided and then use<code>messagingTemplate.convertAndSend</code> which does not apply security. </li> 
 <li> Then people say that "you need to use spring security just like everywhere else" - the problem here is A) that I am SENDING data to the client asynchronously, so B) I will be using this code completely outside of the user's session, possibly from a different user (say to send a notification to another logged in user). </li> 
 </ul> 
 Let me know if this is too closely related to a different post, but I this is a big problem for me and I wanted to do this justice. 
 I can get more details though if anyone needs more details. 
 </div> 
 <div> 
 <a title="show questions tagged 'java'" href="http://stackoverflow.com/questions/tagged/java" rel="nofollow">java</a> 
 <a title="show questions tagged 'spring'" href="http://stackoverflow.com/questions/tagged/spring" rel="nofollow">spring</a> 
 <a title="show questions tagged 'spring-mvc'" href="http://stackoverflow.com/questions/tagged/spring-mvc" rel="nofollow"> spring-mvc</a> 
 <a title="" href="http://stackoverflow.com/questions/tagged/spring-security" rel="nofollow"> spring-security</a> 
 <a title="show questions tagged 'websocket'" href="http://stackoverflow.com/questions/tagged/websocket" rel="nofollow"> websocket</a> 
 </div> 
 <table> 
 <tbody> 
 <tr> 
 <td> 
 <div> 
 <a title="short permalink to this question" href="http://stackoverflow.com/q/25004081" rel="nofollow">share</a> 
 | 
 <a title="" href="http://stackoverflow.com/posts/25004081/edit" rel="nofollow">improve this question</a> 
 </div> </td> 
 <td> 
 <div> 
 <div>
 asked 
 Jul 28 at 20:47 
 </div> 
 <div> 
 <a href="http://stackoverflow.com/users/338844/nitroware" rel="nofollow"></a> 
 <div> 
 <img width="32" height="32" alt="" src="https://www.gravatar.com/avatar/863e7eb84abf7e0fce958e679d81b61d?s=32&amp;d=identicon&amp;r=PG"> 
 </div> 
 </div> 
 <div> 
 <a href="http://stackoverflow.com/users/338844/nitroware" rel="nofollow">Nitroware</a> 
 
 580 
 7 
 22 
 </div> 
 </div> </td> 
 </tr> 
 </tbody> 
 </table> 
 </div> </td> 
 </tr> 
 <tr> 
 <td>&nbsp;</td> 
 <td> 
 <div> 
 <table> 
 <tbody> 
 <tr> 
 <td></td> 
 <td>&nbsp;</td> 
 </tr> 
 </tbody> 
 </table> 
 </div> 
 <div> 
 <a title="Use comments to ask for more information or suggest improvements. Avoid answering questions in comments." rel="nofollow">add a comment</a> 
 &nbsp;|&nbsp; 
 <a title="expand to show all comments on this post, or add one of your own" href="http://stackoverflow.com/questions/25004081/springmvc-websockets-messaging-user-authentication-with-spring-security#" rel="nofollow"></a> 
 </div> </td> 
 </tr> 
 </tbody> 
</table>

## 1 Answer 1 ##

[active][] [oldest][] [votes][]

<table> 
 <tbody> 
 <tr> 
 <td> 
 <div> 
 <a title="This answer is useful" rel="nofollow"> up vote</a> 
 2 
 <a title="This answer is not useful" rel="nofollow">down vote</a> 
 </div> </td> 
 <td> 
 <div> 
 I think you must make these changes: 
 1) You must not enableSimpleBroker for "/user" because it's a special queue handled automatically by the broker 
 2) if the server uses for example the annotation "@SendToUser("/queue/private")" the client must subscribe to the queue "/user/queue/private" : you must not prepend the username in the queue because it's a transparent operation handled by the broker 
 I'm sure this works correctly because I'm using it in my setup. 
 I've not tried with the convertAndSendToUser() method but since its semantic should be the same of the annotation, it should work too. 
 </div> 
 <table> 
 <tbody> 
 <tr> 
 <td> 
 <div> 
 <a title="short permalink to this answer" href="http://stackoverflow.com/a/25021358" rel="nofollow">share</a> 
 | 
 <a title="" href="http://stackoverflow.com/posts/25021358/edit" rel="nofollow">improve this answer</a> 
 </div> </td> 
 <td align="right"> 
 <div> 
 <div>
 answered 
 Jul 29 at 17:22 
 </div> 
 <div> 
 <a href="http://stackoverflow.com/users/1475212/alessandro-polverini" rel="nofollow"></a> 
 <div> 
 <img width="32" height="32" alt="" src="https://www.gravatar.com/avatar/6624870dadbe539d02a0bb24badb4439?s=32&amp;d=identicon&amp;r=PG"> 
 </div> 
 </div> 
 <div> 
 <a href="http://stackoverflow.com/users/1475212/alessandro-polverini" rel="nofollow">Alessandro Polverini</a> 
 
 83 
 8 
 </div> 
 </div> </td> 
 </tr> 
 </tbody> 
 </table> </td> 
 </tr> 
 <tr> 
 <td>&nbsp;</td> 
 <td> 
 <div> 
 <table> 
 <tbody> 
 <tr> 
 <td> 
 <table> 
 <tbody> 
 <tr> 
 <td></td> 
 <td>&nbsp;</td> 
 </tr> 
 </tbody> 
 </table> </td> 
 <td> 
 <div style="display:block"> 
 Great response, thanks so much! I will go ahead and try that now and update you/mark it as solves as soon as I know. –&nbsp; 
 <a title="580 reputation" href="http://stackoverflow.com/users/338844/nitroware" rel="nofollow">Nitroware</a> 
 <a href="http://stackoverflow.com/questions/25004081/springmvc-websockets-messaging-user-authentication-with-spring-security#comment38911000_25021358" rel="nofollow">Jul 29 at 17:31</a> 
 </div> </td> 
 </tr> 
 <tr> 
 <td> 
 <table> 
 <tbody> 
 <tr> 
 <td>1</td> 
 <td>&nbsp;</td> 
 </tr> 
 </tbody> 
 </table> </td> 
 <td> 
 <div style="display:block"> 
 So I tried doing exactly what you had recommended and still it did not work. The critical problem here between our two situations is this: You are using<code>@SendToUser</code> which already has the current users session and scope, and likely the user session. I am trying to send notifications, possibly from another, to a different user using<code>convertAndSendToUser()</code> which is where i am getting my problems from –&nbsp; 
 <a title="580 reputation" href="http://stackoverflow.com/users/338844/nitroware" rel="nofollow">Nitroware</a> 
 <a href="http://stackoverflow.com/questions/25004081/springmvc-websockets-messaging-user-authentication-with-spring-security#comment38913891_25021358" rel="nofollow">Jul 29 at 18:55</a> 
 
 </div> </td> 
 </tr> 
 </tbody> 
 </table> 
 </div> </td> 
 </tr> 
 </tbody> 
</table>

[active]: http://stackoverflow.com/questions/25004081/springmvc-websockets-messaging-user-authentication-with-spring-security?answertab=active#tab-top
[oldest]: http://stackoverflow.com/questions/25004081/springmvc-websockets-messaging-user-authentication-with-spring-security?answertab=oldest#tab-top
[votes]: http://stackoverflow.com/questions/25004081/springmvc-websockets-messaging-user-authentication-with-spring-security?answertab=votes#tab-top