Basic auth is not working on lambda with Spring Boot #279

Defozo · 2019-09-10T13:35:53Z

Framework version: v2.0.0.RELEASE
Implementations: Spring Boot

Scenario

This is my SecurityConfiguration class:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity.csrf().disable()
                .authorizeRequests().anyRequest().authenticated()
                .and().httpBasic();

    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder authentication)
            throws Exception
    {
        authentication.inMemoryAuthentication()
                .withUser("admin")
                .password(passwordEncoder().encode("fsdiojoigjsdoif"))
                .authorities("ROLE_USER");
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

Expected behavior

When I run the project locally it properly shows basic auth and I can authenticate and access my endpoints.

Actual behavior

However, when I deploy it to Lambda it returns HTTP code 500 and prints this:

START RequestId: 298ebee0-275a-4618-96f6-c9535fd0179b Version: $LATEST
13:18:45.132 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder - Starting REQUEST: filter 0-characterEncodingFilter
13:18:45.133 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder - Starting REQUEST: filter 1-errorPageFilter
13:18:45.133 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder - Starting REQUEST: filter 2-springSecurityFilterChain
13:18:45.134 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.AwsHttpServletRequest - Trying to access session. Lambda functions are stateless and should not rely on the session
13:18:45.134 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.AwsHttpServletRequest - Trying to access session. Lambda functions are stateless and should not rely on the session
13:18:45.134 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.AwsHttpServletRequest - Trying to access session. Lambda functions are stateless and should not rely on the session
13:18:45.134 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.AwsHttpServletRequest - Trying to access session. Lambda functions are stateless and should not rely on the session
13:18:45.135 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.AwsHttpServletRequest - Trying to access session. Lambda functions are stateless and should not rely on the session
13:18:45.136 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.AwsHttpServletRequest - Trying to access session. Lambda functions are stateless and should not rely on the session
Sep 10, 2019 1:18:45 PM org.springframework.boot.web.servlet.support.ErrorPageFilter forwardToErrorPage
SEVERE: Forwarding to error page from request [/api/user/add] due to exception [null]
java.lang.NullPointerException
at org.springframework.security.web.savedrequest.HttpSessionRequestCache.saveRequest(HttpSessionRequestCache.java:59)
at org.springframework.security.web.access.ExceptionTranslationFilter.sendStartAuthentication(ExceptionTranslationFilter.java:208)
at org.springframework.security.web.access.ExceptionTranslationFilter.handleSpringSecurityException(ExceptionTranslationFilter.java:182)
at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:138)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:158)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:215)
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357)
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270)
at com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder.doFilter(FilterChainHolder.java:84)
at org.springframework.boot.web.servlet.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:115)
at org.springframework.boot.web.servlet.support.ErrorPageFilter.access$000(ErrorPageFilter.java:59)
at org.springframework.boot.web.servlet.support.ErrorPageFilter$1.doFilterInternal(ErrorPageFilter.java:90)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at org.springframework.boot.web.servlet.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:108)
at com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder.doFilter(FilterChainHolder.java:84)
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
at com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder.doFilter(FilterChainHolder.java:84)
at com.amazonaws.serverless.proxy.internal.servlet.AwsLambdaServletContainerHandler.doFilter(AwsLambdaServletContainerHandler.java:215)
at com.amazonaws.serverless.proxy.spring.SpringBootLambdaContainerHandler.handleRequest(SpringBootLambdaContainerHandler.java:154)
at com.amazonaws.serverless.proxy.spring.SpringBootLambdaContainerHandler.handleRequest(SpringBootLambdaContainerHandler.java:52)
at com.amazonaws.serverless.proxy.internal.LambdaContainerHandler.proxy(LambdaContainerHandler.java:163)
at com.amazonaws.serverless.proxy.internal.LambdaContainerHandler.proxyStream(LambdaContainerHandler.java:198)
at com.example.cognitouseradd.StreamLambdaHandler.handleRequest(StreamLambdaHandler.java:34)
at lambdainternal.EventHandlerLoader$2.call(EventHandlerLoader.java:888)
at lambdainternal.AWSLambda.startRuntime(AWSLambda.java:293)
at lambdainternal.AWSLambda.<clinit>(AWSLambda.java:64)
at java.lang.Class.forName0(Native Method)
at java.lang.Class.forName(Class.java:348)
at lambdainternal.LambdaRTEntry.main(LambdaRTEntry.java:114)
13:18:45.137 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder - Starting REQUEST: filter 0-characterEncodingFilter
13:18:45.137 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder - Starting REQUEST: filter 1-errorPageFilter
13:18:45.137 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder - Starting REQUEST: filter 2-springSecurityFilterChain
13:18:45.138 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.AwsHttpServletRequest - Trying to access session. Lambda functions are stateless and should not rely on the session
13:18:45.138 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.AwsHttpServletRequest - Trying to access session. Lambda functions are stateless and should not rely on the session
13:18:45.138 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.AwsHttpServletRequest - Trying to access session. Lambda functions are stateless and should not rely on the session
13:18:45.138 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder - Starting REQUEST: filter 3-com.amazonaws.serverless.proxy.internal.servlet.FilterChainManager$ServletExecutionFilter
13:18:45.138 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.AwsHttpServletRequest - Trying to access session. Lambda functions are stateless and should not rely on the session
13:18:45.157 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.AwsHttpServletRequest - Trying to access session. Lambda functions are stateless and should not rely on the session
13:18:45.158 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.AwsHttpServletResponse - Response buffer flushed with 128 bytes, latch=1
13:18:45.158 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.AwsHttpServletRequest - Trying to access session. Lambda functions are stateless and should not rely on the session
13:18:45.158 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder - Executed REQUEST: filter 4-com.amazonaws.serverless.proxy.internal.servlet.FilterChainManager$ServletExecutionFilter
13:18:45.158 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder - Executed REQUEST: filter 4-springSecurityFilterChain
13:18:45.158 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder - Executed REQUEST: filter 4-errorPageFilter
13:18:45.158 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder - Executed REQUEST: filter 4-characterEncodingFilter
13:18:45.158 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.AwsHttpServletResponse - Response buffer flushed with 128 bytes, latch=0
13:18:45.158 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder - Executed REQUEST: filter 2-errorPageFilter
13:18:45.158 [main] DEBUG com.amazonaws.serverless.proxy.internal.servlet.FilterChainHolder - Executed REQUEST: filter 2-characterEncodingFilter
13:18:45.158 [main] INFO com.amazonaws.serverless.proxy.internal.LambdaContainerHandler - 83.144.98.130 - [10/09/2019:13:18:45Z] "POST /error HTTP/1.1" 500 128 "-" "PostmanRuntime/7.15.2" combined
END RequestId: 298ebee0-275a-4618-96f6-c9535fd0179b
REPORT RequestId: 298ebee0-275a-4618-96f6-c9535fd0179b Duration: 27.63 ms Billed Duration: 100 ms Memory Size: 2048 MB Max Memory Used: 280 MB
XRAY TraceId: 1-5d77a2b5-55b4eca49658117b6945c9ee SegmentId: 3b064a9d05f901d4 Sampled: true

The text was updated successfully, but these errors were encountered:

sapessi · 2019-09-12T17:21:42Z

I suspect the issue is caused by Spring Security trying to instantiate a session. We do not support sessions in the framework because of the stateless nature of Lambda. Take a look at how we configure SpringSecurity in our unit tests here. We also implemented additional fixes in the core branch to address #275 - they will go out with the next release over the next few weeks.

…uest asynchronously. This was causing race conditions in the SpringBoot 2 WebFlux implementation - requests that had to run through security or validation filters took longer and the library flushed an empty request, which caused the status code to default to 200. This fix addresses issues #279, #304, and #306

* Bump spring.version in /aws-serverless-java-container-spring (#319) Bumps `spring.version` from 5.1.9.RELEASE to 5.2.3.RELEASE. Updates `spring-webmvc` from 5.1.9.RELEASE to 5.2.3.RELEASE - [Release notes](https://github.com/spring-projects/spring-framework/releases) - [Commits](spring-projects/spring-framework@v5.1.9.RELEASE...v5.2.3.RELEASE) Updates `spring-test` from 5.1.9.RELEASE to 5.2.3.RELEASE - [Release notes](https://github.com/spring-projects/spring-framework/releases) - [Commits](spring-projects/spring-framework@v5.1.9.RELEASE...v5.2.3.RELEASE) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Bump spring-webflux in /aws-serverless-java-container-springboot2 (#318) Bumps [spring-webflux](https://github.com/spring-projects/spring-framework) from 5.1.9.RELEASE to 5.2.0.RELEASE. - [Release notes](https://github.com/spring-projects/spring-framework/releases) - [Commits](spring-projects/spring-framework@v5.1.9.RELEASE...v5.2.0.RELEASE) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * ci: Fixing Spring build to use 5.2 as latest * chore(deps): Bump Spring 5.1 path release to address a security vulnerability * chore(deps): Fixing usual spring dependency mess with exlusions out of the spring-security package used in the tests * Fix for issue #317 (#323) * fix issue 317 - use charset from request * update dependencies * update build dependencies, remove spring boot 2.0.x * restoring ci config Co-authored-by: Stefano Buliani <2996317+sapessi@users.noreply.github.com> * test: Fixed Spring security tests for SpringBoot 2, added validation tests and updated servlet tests to use the new servletApplication option * fix: Avoid flushing the response buffer if we are dispatching the request asynchronously. This was causing race conditions in the SpringBoot 2 WebFlux implementation - requests that had to run through security or validation filters took longer and the library flushed an empty request, which caused the status code to default to 200. This fix addresses issues #279, #304, and #306 * chore(deps): Bump spring dependency version and added webmvc optional dependency to truly support Servlet-only server * feat: New application type parameter to SpringBootLambdaContainerHandler that tells the framework whether to start a reactive or servlet-based embedded server. Also added a new servletApplication method to the builder object. * test: Fixed UTF-8 encoding test * ci: Fixed dependencies for CI run on SpringBoot 2 * ci: More Spring dependency convergence issues during CI * fix: Added null-check on getServerName in case the multi-value headers property is null. Unlikely outside of tests but better safe than sorry. This addresses #327 * fix: Changed servlet initialization mechanism so that servlet that requests load on startup are initialized right away, as part of the initialization() method call in LambdaServletContainerHandler. Also centralized the lazy Servlet initialization to the ServletExecutionFilter so that we don't have code scattered all around. This begins to address #287 * feat: Added new 0-parameter constructor for async initializer that uses the actual JVM start time to calculate the timeout milliseconds. Also added the new method to the builder object and deprecated the current method that receives a milliseconds epoch parameter. I'm not deprecating the constructor of the async initializer class that receives the parameter as it may still be useful for tests. This change was suggested in #287 * fix: Updated SpringBoot 1.x handler to use the new servlet initialization mechanism * ci: switch SpringBoot slow integration test to use a custom async time since the JVM is reused for both tests in the and we cannot reuse the actual JVM init time * feat: New models for HTTP API support for #329 * feat: First implementation of HTTP API servlet request, request reader, and security context writer - continuing to address #329 * test: Basic unit tests for the new HTTP API support in core library (#329) * feat: Updated log formatter to support both versions (1 and 2) of the proxy request model (#329) * feat: Further generified request readers to read to a generic HttpServletRequest rather than specific implementations of it. This makes it easier to create container handler implementations that support HTTP API, API Gateway, and ALB (#329) * test: Fixed tests for new logged and generified request readers * feat: Added HTTP API support to Jersey implementation with new getHttpApiV2ProxyHandler method (#329) * feat: Added HTTP API support to Spark implementation (#329) * feat: Added HTTP API support to Spring implementation (#329) * feat: HTTP API support in SpringBoot 2 implementation. bug: Fixed an issue with the implementation of AsyncContext where it wasn't dispatching if the handler wasn't set * feat: First pass of HTTP API support in struts 2 implementation (#329) * fix: Added support for HTTP APIs to the request dispatcher * chore(deps): Dependency bump all around. Rotated Jersey ci versions * fix: Updated stream handling logic to work with reactive applications as suggested in #316 * test: Added unit test to replicate #333 * feat: New configuration parameter to skip exception mapping and allow exception to bubble up from #307 * fix: Fixed spotbugs issue in RuntimeException cast * test: Added tests for more complex content types mentioned in issue #315 * docs: Updated samples to support SAM CLI operations out of the box to address #293 and switched to HTTP API by default * feat: Updated archetypes to work out of the box with the SAM CLI, continuing to address #293 * chore: License header pass on the entire project * fix: Set default value for setDisableException mapper in config to false * fix: Updated default initialization timeout to 20 seconds Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Eran Medan <eranmeda@amazon.com>

sapessi · 2020-04-08T20:51:10Z

Release 1.5 is making its way out to Maven central

estigma88 · 2020-05-24T22:36:14Z

Hi everyone, was this fixed? I am getting the same error with the 1.5 version

mohit224 · 2020-06-01T16:13:28Z

@estigma88 were you able to find a fix I am also getting the same error?
I reported this to @sapessi on a different thread:
#330

sapessi · 2020-06-08T15:01:49Z

I'll reopen #330 and work to replicate there.

ozgreat mentioned this issue Jan 10, 2020

How to configure spring security for lambda? #314

Closed

phuonghuynh mentioned this issue Feb 13, 2020

Replace spring security function ISO-TC211/iso-geodetic-registry#30

Open

sapessi mentioned this issue Mar 31, 2020

Response stream flushed early for WebFlux applications wrapping a CompletableFuture #304

Closed

sapessi added help wanted need feedback labels Mar 31, 2020

sapessi added this to the Release 1.5 milestone Apr 7, 2020

sapessi closed this as completed Apr 8, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Basic auth is not working on lambda with Spring Boot #279

Basic auth is not working on lambda with Spring Boot #279

Defozo commented Sep 10, 2019 •

edited

Loading

sapessi commented Sep 12, 2019

sapessi commented Apr 8, 2020

estigma88 commented May 24, 2020

mohit224 commented Jun 1, 2020 •

edited

Loading

sapessi commented Jun 8, 2020

Basic auth is not working on lambda with Spring Boot #279

Basic auth is not working on lambda with Spring Boot #279

Comments

Defozo commented Sep 10, 2019 • edited Loading

Scenario

Expected behavior

Actual behavior

sapessi commented Sep 12, 2019

sapessi commented Apr 8, 2020

estigma88 commented May 24, 2020

mohit224 commented Jun 1, 2020 • edited Loading

sapessi commented Jun 8, 2020

Defozo commented Sep 10, 2019 •

edited

Loading

mohit224 commented Jun 1, 2020 •

edited

Loading