Spring Webflux Websocket Security - Basic Authentication

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.core.userdetails.MapReactiveUserDetailsService;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.server.SecurityWebFilterChain;
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers;
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.PathMatchers;
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.MatchResultMatchers;

@Configuration
@EnableWebFluxSecurity
public class WebSocketSecurityConfig {

    // Configure basic authentication with in-memory user details
    @Bean
    public MapReactiveUserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
                .username("user")
                .password("password")
                .roles("USER")
                .build();
        return new MapReactiveUserDetailsService(user);
    }

    // Configure security for WebSocket endpoints
    @Bean
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        http
            .authorizeExchange()
                .matchers(ServerWebExchangeMatchers.pathMatchers("/ws/**"))
                .authenticated()
                .and()
            .httpBasic(Customizer.withDefaults());

        return http.build();
    }
}

@Configuration
@EnableWebSocketSecurity
public class WebSocketSecurityConfig {

    // This method creates a bean of type AuthorizationManager<Message<?>>.
    // The AuthorizationManager is responsible for handling message-level authorization.
    // It takes a MessageMatcherDelegatingAuthorizationManager.Builder as a parameter.
    @Bean
    AuthorizationManager<Message<?>> messageAuthorizationManager(MessageMatcherDelegatingAuthorizationManager.Builder messages) {
        // The following code configures message-level authorization rules.
        messages
            // Specify that messages with destination "/user/**" should have the "USER" role.
            .simpDestMatchers("/user/**").hasRole("USER");

        // Return the built MessageMatcherDelegatingAuthorizationManager.
        return messages.build();
    }
}

import org.springframework.context.annotation.Configuration;
import org.springframework.messaging.simp.config.MessageBrokerRegistry;
import org.springframework.security.config.annotation.web.socket.AbstractSecurityWebSocketMessageBrokerConfigurer;
import org.springframework.security.config.annotation.web.socket.MessageSecurityMetadataSourceRegistry;
import org.springframework.web.socket.config.annotation.EnableWebSocketMessageBroker;
import org.springframework.web.socket.config.annotation.StompEndpointRegistry;
import org.springframework.web.socket.config.annotation.WebSocketMessageBrokerConfigurer;

@Configuration
@EnableWebSocketMessageBroker
public class SocketSecurityConfig extends AbstractSecurityWebSocketMessageBrokerConfigurer {

    /**
     * Configure message broker options.
     */
    @Override
    protected void configureMessageBroker(MessageBrokerRegistry registry) {
        // Enable a simple memory-based message broker to send messages to and receive messages from clients
        registry.enableSimpleBroker("/secured");
        
        // Set the prefix for destinations that the application is going to use
        registry.setApplicationDestinationPrefixes("/app");
    }

    /**
     * Configure security options for the WebSocket.
     */
    @Override
    protected void configureInbound(MessageSecurityMetadataSourceRegistry messages) {
        // Allow all messages to and from the "/app" destination (application-level)
        messages.simpDestMatchers("/app/**").permitAll();
        
        // Allow messages from all authenticated users to the "/secured/**" destination
        messages.simpDestMatchers("/secured/**").authenticated();
    }

    /**
     * Register STOMP endpoints for WebSocket communication.
     */
    @Override
    public void registerStompEndpoints(StompEndpointRegistry registry) {
        // Allow WebSocket connections on the "/socket" endpoint with SockJS fallback
        registry.addEndpoint("/socket")
                .setAllowedOrigins("*")
                .withSockJS();
    }
}

import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
@EnableWebSecurity
@ComponentScan("com.baeldung.springsecuredsockets")
public class SecurityConfig {

    /**
     * Configure the security filter chain.
     * Order of precedence is crucial; matching occurs from top to bottom.
     */
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(authorizationManagerRequestMatcherRegistry ->
                authorizationManagerRequestMatcherRegistry
                        // Permit access to these URLs without authentication
                        .requestMatchers("/", "/index", "/authenticate").permitAll()
                        
                        // URLs under "/secured/" require authentication
                        .requestMatchers("/secured/**/**", "/secured/**/**/**", "/secured/socket", "/secured/success").authenticated()
                        
                        // Any other requests require authentication
                        .anyRequest().authenticated())
            
            // Configure form login settings
            .formLogin(httpSecurityFormLoginConfigurer ->
                    httpSecurityFormLoginConfigurer
                            .loginPage("/login").permitAll()  // Custom login page
                            .usernameParameter("username")  // Username parameter in the login form
                            .passwordParameter("password")  // Password parameter in the login form
                            .loginProcessingUrl("/authenticate")  // URL where the login form is submitted
                            .successHandler(loginSuccessHandler())  // Custom success handler
                            .failureUrl("/denied").permitAll())  // URL to redirect on login failure
            
            // Additional configurations can be added here, such as logout settings, CSRF protection, etc.
            // ...

        return http.build();
    }

    // You can define a custom login success handler bean if needed
    @Bean
    public AuthenticationSuccessHandler loginSuccessHandler() {
        return new CustomAuthenticationSuccessHandler();
    }

    // Other beans and configurations can be added as needed
}

import org.springframework.messaging.handler.annotation.MessageMapping;
import org.springframework.messaging.handler.annotation.SendTo;
import org.springframework.stereotype.Controller;

import java.text.SimpleDateFormat;
import java.util.Date;

@Controller
public class SocketController {

    // Handle incoming messages from the "/secured/chat" destination
    @MessageMapping("/secured/chat")
    
    // Send the processed message to the "/secured/history" destination
    @SendTo("/secured/history")
    public OutputMessage send(Message msg) throws Exception {
        // Create a new OutputMessage with the sender, message text, and timestamp
        return new OutputMessage(
                msg.getFrom(),
                msg.getText(),
                new SimpleDateFormat("HH:mm").format(new Date()));
    }
}

import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        // Disable CSRF protection
        http.csrf(AbstractHttpConfigurer::disable)
            // Configure other security options as needed
            // ...

            // Configure security headers, disabling frame options
            .headers(httpSecurityHeadersConfigurer ->
                httpSecurityHeadersConfigurer.frameOptions(HeadersConfigurer.FrameOptionsConfig::disable)
            )
            
            // Configure authorization for HTTP requests using default settings
            .authorizeHttpRequests(Customizer.withDefaults());

        // Build and return the SecurityFilterChain
        return http.build();
    }
}