baeldung / spring-security-registration Goto Github PK

View Code? Open in Web Editor NEW

1.6K 123.0 1.2K 29.14 MB

Go further into "Learn Spring Security":

Home Page: https://bit.ly/github-lss

License: MIT License

Java 80.79% HTML 19.21%

spring-security spring

spring-security-registration's Introduction

Login and Registration Example Project with Spring Security

If you're already a student of Learn Spring Security, you can get started diving deeper into registration with Module 2
If you're not yet a student, you can get access to the course here: https://bit.ly/github-lss

Relevant Articles:

Build and Deploy the Project

mvn clean install

This is a Spring Boot project, so you can deploy it by simply using the main class: Application.java

Once deployed, you can access the app at:

https://localhost:8081

Set up MySQL

By default, the project is configured to use the embedded H2 database. If you want to use the MySQL instead, you need to uncomment relevant section in the application.properties and create the db user as shown below:

mysql -u root -p 
> CREATE USER 'tutorialuser'@'localhost' IDENTIFIED BY 'tutorialmy5ql';
> GRANT ALL PRIVILEGES ON *.* TO 'tutorialuser'@'localhost';
> FLUSH PRIVILEGES;

Set up Email

You need to configure the email by providing your own username and password in application.properties You also need to use your own host, you can use Amazon or Google for example.

AuthenticationSuccessHandler configuration for Custom Login Page article

If you want to activate the configuration for the article Custom Login Page for Returning User, then you need to comment the @Component("myAuthenticationSuccessHandler") annotation in the MySimpleUrlAuthenticationSuccessHandler and uncomment the same in MyCustomLoginAuthenticationSuccessHandler.

Feature toggle for Geo IP Lib

The geolocation checks do not work for the IP addresses 127.0.0.1 and 0.0.0.0, which can be a problem when running the application locally or in a test environment. To enable/disable the check on the geolocation, set the property geo.ip.lib.enabled to true/false; this is false by default.

spring-security-registration's People

Contributors

Stargazers

Watchers

Forkers

fhabumugisha sarweshs faisal-w joaonlima pliesveld dannywang0818 admilsoncossa tomdkt hendisantika johan1a zroe000 supermohit vinayak63 sangkyunyoon dustinguosz ystarling mahee522 brainagenet dongweibox lor6 fiston amoschov deena-p qiutongyeluo esanchezros sffej apachesun snandasena andrewtobilko jameswilliamquinn2016 nealfu kotireddy drizzentic quickeee zaureus clev0097 littleyang luiz158 exexzian sartrebrasil team55 nick-xu damozhiying toanhd-ibl avanishkumar28 mgashraf caiter78 liuxingzhuri jensworkgit sudip7 firstontech meataur alphadyz osanuy sametozcan oucem sartikakrb koushiknus syndev1 gatmeister naddame dc43360 vinitsolanki sauravmedisys yassinezer huynhtruong guotechfin juricajaman algunning-hmh jghankins iammatheusmoura juancornelioguzman marckandler jarda-mlejnek gwokudasam sergiimanko sushiljic aminyuddin kevinjam adrianprecub marcinzelek tiennguyen231195 kiranpreet-nerd atlantis-maya achal-s zhaoyingpei99 rekotek leandroveiga eljah harpreet-nerd congnguyenit moalfa longbaobao rejish4gt azeez148 ishara lesliesu aharpour sonimehul mrhanachoo

spring-security-registration's Issues

Error creating bean with name 'entityManagerFactory' defined in class path resource [org/baeldung/spring/PersistenceJPAConfig.class]: Invocation of init

web - 2018-10-17 13:02:24,208 [http-apr-8080-exec-23] INFO o.h.d.Dialect - HHH000400: Using dialect: org.hibernate.dialect.MySQL55Dialect
Oct 17, 2018 1:02:25 PM org.apache.catalina.core.ContainerBase addChildInternal
SEVERE: ContainerBase.addChild: start:
org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina].StandardHost[localhost].StandardContext[/spring-security-login-and-registration]]
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:162)
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:1018)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:994)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:712)
at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:587)
web - 2018-10-17 13:02:25,720 [http-apr-8080-exec-23] WARN o.s.b.w.s.c.AnnotationConfigServletWebServerApplicationContext - Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'entityManagerFactory' defined in class path resource [org/baeldung/spring/PersistenceJPAConfig.class]: Invocation of init method failed; nested exception is javax.persistence.PersistenceException: [PersistenceUnit: default] Unable to build Hibernate SessionFactory; nested exception is org.hibernate.cfg.beanvalidation.IntegrationException: Error activating Bean Validation integration
web - 2018-10-17 13:02:25,748 [http-apr-8080-exec-23] ERROR o.s.b.SpringApplication - Application run failed
o.s.b.f.BeanCreationException: Error creating bean with name 'entityManagerFactory' defined in class path resource [org/baeldung/spring/PersistenceJPAConfig.class]: Invocation of init method failed; nested exception is javax.persistence.PersistenceException: [PersistenceUnit: default] Unable to build Hibernate SessionFactory; nested exception is org.hibernate.cfg.beanvalidation.IntegrationException: Error activating Bean Validation integration
at org.apache.catalina.startup.HostConfig.check(HostConfig.java:1815)
at o.s.b.f.s.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1699)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at o.s.b.f.s.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:573)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at o.s.b.f.s.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:495)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at o.s.b.f.s.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:317)
at java.lang.reflect.Method.invoke(Method.java:498)
at o.s.b.f.s.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222)
at org.apache.tomcat.util.modeler.BaseModelMBean.invoke(BaseModelMBean.java:301)
... 57 frames truncated
Caused by: j.p.PersistenceException: [PersistenceUnit: default] Unable to build Hibernate SessionFactory; nested exception is org.hibernate.cfg.beanvalidation.IntegrationException: Error activating Bean Validation integration
at o.s.o.j.AbstractEntityManagerFactoryBean.buildNativeEntityManagerFactory(AbstractEntityManagerFactoryBean.java:402)
at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.invoke(DefaultMBeanServerInterceptor.java:819)
at o.s.o.j.AbstractEntityManagerFactoryBean.afterPropertiesSet(AbstractEntityManagerFactoryBean.java:377)
at com.sun.jmx.mbeanserver.JmxMBeanServer.invoke(JmxMBeanServer.java:801)
at o.s.o.j.LocalContainerEntityManagerFactoryBean.afterPropertiesSet(LocalContainerEntityManagerFactoryBean.java:341)
at org.apache.catalina.manager.ManagerServlet.check(ManagerServlet.java:1514)
at o.s.b.f.s.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1758)
at org.apache.catalina.manager.ManagerServlet.deploy(ManagerServlet.java:910)
at o.s.b.f.s.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1695)
at org.apache.catalina.manager.ManagerServlet.doGet(ManagerServlet.java:365)
... 61 common frames omitted
Caused by: o.h.c.b.IntegrationException: Error activating Bean Validation integration
at javax.servlet.http.HttpServlet.service(HttpServlet.java:624)
at o.h.c.b.BeanValidationIntegrator.integrate(BeanValidationIntegrator.java:138)
at o.h.i.SessionFactoryImpl.(SessionFactoryImpl.java:281)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
at o.h.b.i.SessionFactoryBuilderImpl.build(SessionFactoryBuilderImpl.java:462)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
at o.h.j.b.i.EntityManagerFactoryBuilderImpl.build(EntityManagerFactoryBuilderImpl.java:892)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at o.s.o.j.v.SpringHibernateJpaPersistenceProvider.createContainerEntityManagerFactory(SpringHibernateJpaPersistenceProvider.java:57)
... 2 frames truncated
... 65 common frames omitted
Caused by: j.l.NoClassDefFoundError: javax/el/ELManager
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at o.h.v.m.ResourceBundleMessageInterpolator.buildExpressionFactory(ResourceBundleMessageInterpolator.java:88)
at o.h.v.m.ResourceBundleMessageInterpolator.(ResourceBundleMessageInterpolator.java:47)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at o.h.v.i.e.ConfigurationImpl.getDefaultMessageInterpolator(ConfigurationImpl.java:474)
at org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:109)
at o.h.v.i.e.ConfigurationImpl.getDefaultMessageInterpolatorConfiguredWithClassLoader(ConfigurationImpl.java:650)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at o.h.v.i.e.ConfigurationImpl.getMessageInterpolator(ConfigurationImpl.java:397)
... 11 frames truncated
... 71 common frames omitted
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:603)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:104)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:1025)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1137)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)
at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.doRun(AprEndpoint.java:2555)
at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:2544)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'entityManagerFactory' defined in class path resource [org/baeldung/spring/PersistenceJPAConfig.class]: Invocation of init method failed; nested exception is javax.persistence.PersistenceException: [PersistenceUnit: default] Unable to build Hibernate SessionFactory; nested exception is org.hibernate.cfg.beanvalidation.IntegrationException: Error activating Bean Validation integration
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1699)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:573)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:495)
at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:317)
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:315)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:199)
at org.springframework.context.support.AbstractApplicationContext.getBean(AbstractApplicationContext.java:1089)
at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:859)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:550)
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:140)
at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:762)
at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:398)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:330)
at org.springframework.boot.web.servlet.support.SpringBootServletInitializer.run(SpringBootServletInitializer.java:157)
at org.springframework.boot.web.servlet.support.SpringBootServletInitializer.createRootApplicationContext(SpringBootServletInitializer.java:137)
at org.springframework.boot.web.servlet.support.SpringBootServletInitializer.onStartup(SpringBootServletInitializer.java:91)
at org.springframework.web.SpringServletContainerInitializer.onStartup(SpringServletContainerInitializer.java:172)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5669)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:145)
... 42 more
Caused by: javax.persistence.PersistenceException: [PersistenceUnit: default] Unable to build Hibernate SessionFactory; nested exception is org.hibernate.cfg.beanvalidation.IntegrationException: Error activating Bean Validation integration
at org.springframework.orm.jpa.AbstractEntityManagerFactoryBean.buildNativeEntityManagerFactory(AbstractEntityManagerFactoryBean.java:402)
at org.springframework.orm.jpa.AbstractEntityManagerFactoryBean.afterPropertiesSet(AbstractEntityManagerFactoryBean.java:377)
at org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean.afterPropertiesSet(LocalContainerEntityManagerFactoryBean.java:341)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1758)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1695)
... 61 more
Caused by: org.hibernate.cfg.beanvalidation.IntegrationException: Error activating Bean Validation integration
at org.hibernate.cfg.beanvalidation.BeanValidationIntegrator.integrate(BeanValidationIntegrator.java:138)
at org.hibernate.internal.SessionFactoryImpl.(SessionFactoryImpl.java:281)
at org.hibernate.boot.internal.SessionFactoryBuilderImpl.build(SessionFactoryBuilderImpl.java:462)
at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.build(EntityManagerFactoryBuilderImpl.java:892)
at org.springframework.orm.jpa.vendor.SpringHibernateJpaPersistenceProvider.createContainerEntityManagerFactory(SpringHibernateJpaPersistenceProvider.java:57)
at org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean.createNativeEntityManagerFactory(LocalContainerEntityManagerFactoryBean.java:365)
at org.springframework.orm.jpa.AbstractEntityManagerFactoryBean.buildNativeEntityManagerFactory(AbstractEntityManagerFactoryBean.java:390)
... 65 more
Caused by: java.lang.NoClassDefFoundError: javax/el/ELManager
at org.hibernate.validator.messageinterpolation.ResourceBundleMessageInterpolator.buildExpressionFactory(ResourceBundleMessageInterpolator.java:88)
at org.hibernate.validator.messageinterpolation.ResourceBundleMessageInterpolator.(ResourceBundleMessageInterpolator.java:47)
at org.hibernate.validator.internal.engine.ConfigurationImpl.getDefaultMessageInterpolator(ConfigurationImpl.java:474)
at org.hibernate.validator.internal.engine.ConfigurationImpl.getDefaultMessageInterpolatorConfiguredWithClassLoader(ConfigurationImpl.java:650)
at org.hibernate.validator.internal.engine.ConfigurationImpl.getMessageInterpolator(ConfigurationImpl.java:397)
at org.hibernate.validator.internal.engine.ValidatorFactoryImpl.(ValidatorFactoryImpl.java:183)
at org.hibernate.validator.HibernateValidator.buildValidatorFactory(HibernateValidator.java:38)
at org.hibernate.validator.internal.engine.ConfigurationImpl.buildValidatorFactory(ConfigurationImpl.java:364)
at javax.validation.Validation.buildDefaultValidatorFactory(Validation.java:103)
at org.hibernate.cfg.beanvalidation.TypeSafeActivator.getValidatorFactory(TypeSafeActivator.java:501)
at org.hibernate.cfg.beanvalidation.TypeSafeActivator.activate(TypeSafeActivator.java:84)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.hibernate.cfg.beanvalidation.BeanValidationIntegrator.integrate(BeanValidationIntegrator.java:132)
... 71 more

Oct 17, 2018 1:02:25 PM org.apache.catalina.startup.HostConfig deployDescriptor
SEVERE: Error deploying configuration descriptor D:\apache-tomcat-7.0.91\conf\Catalina\localhost\spring-security-login-and-registration.xml
java.lang.IllegalStateException: ContainerBase.addChild: start: org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina].StandardHost[localhost].StandardContext[/spring-security-login-and-registration]]
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:1022)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:994)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:652)
at org.apache.catalina.startup.HostConfig.deployDescriptor(HostConfig.java:712)
at org.apache.catalina.startup.HostConfig.deployApps(HostConfig.java:587)
at org.apache.catalina.startup.HostConfig.check(HostConfig.java:1815)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.tomcat.util.modeler.BaseModelMBean.invoke(BaseModelMBean.java:301)
at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.invoke(DefaultMBeanServerInterceptor.java:819)
at com.sun.jmx.mbeanserver.JmxMBeanServer.invoke(JmxMBeanServer.java:801)
at org.apache.catalina.manager.ManagerServlet.check(ManagerServlet.java:1514)
at org.apache.catalina.manager.ManagerServlet.deploy(ManagerServlet.java:910)
at org.apache.catalina.manager.ManagerServlet.doGet(ManagerServlet.java:365)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:624)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.catalina.filters.SetCharacterEncodingFilter.doFilter(SetCharacterEncodingFilter.java:109)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:603)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:104)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:1025)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1137)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)
at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.doRun(AprEndpoint.java:2555)
at org.apache.tomcat.util.net.AprEndpoint$SocketProcessor.run(AprEndpoint.java:2544)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)

Who can help?

Regards

i can't found the sql for creating database table

hello,i can't found the sql for creating database table from the doc,i run the appilication and the Console output " CommandAcceptanceException Caused by: c.m.j.e.j.MySQLSyntaxErrorException: Table 'registration_02.hibernate_sequence' doesn't exist"

Broken code in UserService.java

Hello, the project does not compile due to an error in src/main/java/com/baeldung/service/UserService.java : the variable env identifier type is missing.

Hibernate create-drop

Hello am kind of wondering if i can change the create-drop property of the hibernate. I don't want my tables to be drop. I want to use this configuration in production

MFA keeps failing: totp validation always returns false

I have followed the code and setup a new account and enabled MFA. However the totp verification keeps returning false. I have tried time sync on the Google Authenticator app. What else could be wrong?

CSRF Support

Since this topic covers security and Spring Security has quite a bit of out of the box security features, I am surprised to see CSRF specially disabled in SecSecurityConfig.java.

I have tried to disable it by changing csrf().disable() to just csrf(), but when testing the application goes consistently states session invalid after trying to login and then I finally received the following error:
There was an unexpected error (type=Forbidden, status=403). Invalid CSRF Token 'null' was found on the request parameter '_csrf' or header 'X-CSRF-TOKEN'.

What is your reason for turning off this feature? Have you tried to implement it and could update this application to support it? Maybe a future topic for your site?

Per spring.io:

When should you use CSRF protection? Our recommendation is to use CSRF protection for any request that could be processed by a browser by normal users. If you are only creating a service that is used by non-browser clients, you will likely want to disable CSRF protection.

reCAPTCHA v3

Hi @eugenp! how can I change to the new version? https://developers.google.com/recaptcha/docs/v3

error in registration process

Hi,
I'm using ubuntu and eclipse.
I enter to the page http://localhost:8081/registration.html
I put my name, and email, and all the data.

And I have the next error in page when I push the button:

"Se produjo un error"

And the console output:

web - 2020-07-25 21:06:08,206 [http-nio-8081-exec-4] ERROR c.b.w.e.RestResponseEntityExceptionHandler - 500 Status Code
o.s.m.MailSendException: Mail server connection failed; nested exception is javax.mail.MessagingException: Could not connect to SMTP host: smtp.gmail.com, port: 465;
nested exception is:
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. Failed messages: javax.mail.MessagingException: Could not connect to SMTP host: smtp.gmail.com, port: 465;
nested exception is:
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at o.s.m.j.JavaMailSenderImpl.doSend(JavaMailSenderImpl.java:448)
at o.s.m.j.JavaMailSenderImpl.send(JavaMailSenderImpl.java:323)
at o.s.m.j.JavaMailSenderImpl.send(JavaMailSenderImpl.java:312)
at c.b.r.l.RegistrationListener.confirmRegistration(RegistrationListener.java:43)
at c.b.r.l.RegistrationListener.onApplicationEvent(RegistrationListener.java:34)
... 86 frames truncated
Caused by: j.m.MessagingException: Could not connect to SMTP host: smtp.gmail.com, port: 465
at c.s.m.s.SMTPTransport.openServer(SMTPTransport.java:2211)
at c.s.m.s.SMTPTransport.protocolConnect(SMTPTransport.java:722)
at j.m.Service.connect(Service.java:342)
at o.s.m.j.JavaMailSenderImpl.connectTransport(JavaMailSenderImpl.java:518)
at o.s.m.j.JavaMailSenderImpl.doSend(JavaMailSenderImpl.java:437)
... 90 common frames omitted
Caused by: j.n.s.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at s.s.s.Alert.createSSLException(Alert.java:131)
at s.s.s.TransportContext.fatal(TransportContext.java:326)
at s.s.s.TransportContext.fatal(TransportContext.java:269)
at s.s.s.TransportContext.fatal(TransportContext.java:264)
at s.s.s.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:645)
... 15 frames truncated
... 94 common frames omitted
Caused by: s.s.v.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at s.s.v.PKIXValidator.doBuild(PKIXValidator.java:439)
at s.s.v.PKIXValidator.engineValidate(PKIXValidator.java:306)
at s.s.v.Validator.validate(Validator.java:264)
at s.s.s.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:313)
at s.s.s.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:222)
... 2 frames truncated
... 109 common frames omitted
Caused by: s.s.p.c.SunCertPathBuilderException: unable to find valid certification path to requested target
at s.s.p.c.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
at s.s.p.c.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
at j.s.c.CertPathBuilder.build(CertPathBuilder.java:297)
at s.s.v.PKIXValidator.doBuild(PKIXValidator.java:434)
... 115 common frames omitted

Double login path

I see a duplicate of /login* in the WebSecurityConfigurerAdapter.

spring-security-registration/src/main/java/org/baeldung/spring/SecSecurityConfig.java

Line 80 in b17232a

 .antMatchers("/login*","/login*", "/logout*", "/signin/**", "/signup/**", "/customLogin", 

Is second erroneous and there should only be one /login** or just /login*?

Problem with user case Change Password

I allso wanted to report the problem to change the password when you are authenticated.
Have a nice day 😊

I have some problems with the whole project

Hi, someone can tell me if importing the project is working with all its use cases. I have several errors such as: password change, login etc.

html file name misspelled

just an fyi,

under src/main/resources/templates, there's a file named regitrationConfirm.html

Probably should be registrationConfirm.html

Error at login

Hi,

I was able to successfully register using Gmail account. I could successfully complete the verification process which have set USER_ACCOUNT.ENABLED to 1 against my user account row in database.

But now when I try to login, I get following exception

j.l.RuntimeException: com.maxmind.geoip2.exception.AddressNotFoundException: The address 0:0:0:0:0:0:0:1 is not in the database.
at o.b.s.MySimpleUrlAuthenticationSuccessHandler.loginNotification(MySimpleUrlAuthenticationSuccessHandler.java:63)
at o.b.s.MySimpleUrlAuthenticationSuccessHandler.onAuthenticationSuccess(MySimpleUrlAuthenticationSuccessHandler.java:53)
at o.s.s.w.a.AbstractAuthenticationProcessingFilter.successfulAuthentication(AbstractAuthenticationProcessingFilter.java:326)
at o.s.s.w.a.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:240)
at o.s.s.w.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:334)
... 36 frames truncated
Caused by: c.m.g.e.AddressNotFoundException: The address 0:0:0:0:0:0:0:1 is not in the database.
at c.m.g.DatabaseReader.get(DatabaseReader.java:188)
at c.m.g.DatabaseReader.city(DatabaseReader.java:233)
at o.b.s.DeviceService.getIpLocation(DeviceService.java:113)
at o.b.s.DeviceService.verifyDevice(DeviceService.java:57)
at o.b.s.MySimpleUrlAuthenticationSuccessHandler.loginNotification(MySimpleUrlAuthenticationSuccessHandler.java:59)
... 40 common frames omitted

I tried both ways. First by entering only email and password, gives above exception. And then I entered email, password and verification token in the Google Authenticator Verification Code field.

How can I fix this login error?

Already logged users can view login page

Runtime failure Missing EL implementation in maven pom

I have have been getting the following error when I start the application

HV000183: Unable to initialize 'javax.el.ExpressionFactory'. Check that you have the EL dependencies on the classpath, or use ParameterMessageInterpolator instead spring security

The error seems to complaining about missing of the implementation which I added and it worked.

	<dependency>
	    <groupId>org.glassfish</groupId>
	    <artifactId>javax.el</artifactId>
	    <version>3.0.0</version>
	</dependency>

Resend email if token is lost

Hi @eugenp, im not sure if this is the right place to ask, how could the user enable his account if the token is lost? (The email could have been deleted by spam protection for example.) What do i have to change in order to let the user resend an e-mail with a new token if he only knows username and password?
Thanks in advance,
Tobias

Can we implement a new user case as login with facebook and google

And create a new user with the email of the login

Error in POM

[ERROR] The build could not read 1 project -> [Help 1]
org.apache.maven.project.ProjectBuildingException: Some problems were encountered while processing the POMs:
[WARNING] 'dependencies.dependency.(groupId:artifactId:type:classifier)' must be unique: org.thymeleaf.extras:thymeleaf-extras-springsecurity4:jar -> duplicate declaration of version (?) @ line 64, column 21
[FATAL] Non-readable POM /home/ole/Sandbox/pom.xml: input contained no data @ /home/ole/Sandbox/pom.xml

Access to variable "param" is forbidden in this context.

do you have ever test the full registration process every time you do a version-upgrade?
thymeleaf-spring5 does not allow to access param .`Access to variable "param" is forbidden in this context. thymeleaf-spring5-3.0.11.RELEASE
org.thymeleaf.spring5.expression.SPELContextMapWrapper#containsKey

public boolean containsKey(final Object key) {

    if (this.evaluationContext.isVariableAccessRestricted()) {
        if (REQUEST_PARAMETERS_RESTRICTED_VARIABLE_NAME.equals(key)) {
            throw new TemplateProcessingException(
                    "Access to variable \"" + key + "\" is forbidden in this context. Note some restrictions apply to " +
                    "variable access. For example, direct access to request parameters is forbidden in preprocessing and " +
                    "unescaped expressions, in TEXT template mode, in fragment insertion specifications and " +
                    "in some specific attribute processors.");
        }
    }
    // We will be NOT calling this.context.containsVariable(key) as it could be very inefficient in web
    // environments (based on HttpServletRequest#getAttributeName()), so we will just consider that every possible
    // element exists in an IContext, and simply return null for those not found
    return this.context != null;
}

so code like return "redirect:/console.html?lang=" + locale.getLanguage(); and <div th:if="${param.message != null}" class="alert alert-info" th:utext="${param.message[0]}">message</div> need to be change to something else.😄

Javax Validation Exception

Hi am using Springboot 1.5.3 with this tutorial and I had this exception
web - 2017-06-02 20:14:05,199 [http-nio-8081-exec-3] ERROR o.m.w.e.RestResponseEntityExceptionHandler - 500 Status Code
j.v.ValidationException: HV000028: Unexpected exception during isValid call.
at o.h.v.i.e.c.ConstraintTree.validateSingleConstraint(ConstraintTree.java:451)
at o.h.v.i.e.c.ConstraintTree.validateConstraints(ConstraintTree.java:127)
at o.h.v.i.e.c.ConstraintTree.validateConstraints(ConstraintTree.java:87)
at o.h.v.i.m.c.MetaConstraint.validateConstraint(MetaConstraint.java:73)
at o.h.v.i.e.ValidatorImpl.validateMetaConstraint(ValidatorImpl.java:620)
... 95 frames truncated
Caused by: j.l.NullPointerException: null
at o.m.v.PasswordMatchesValidator.isValid(PasswordMatchesValidator.java:18)
at o.h.v.i.e.c.ConstraintTree.validateSingleConstraint(ConstraintTree.java:448)
... 99 common frames omitted

Runtime error due to rest-assured dependency

When starting the project, spring-boot returns the following exception:

java.lang.NoClassDefFoundError: Could not initialize class org.codehaus.groovy.vmplugin.v7.Java7
	at org.codehaus.groovy.vmplugin.VMPluginFactory.<clinit>(VMPluginFactory.java:43)
	at org.codehaus.groovy.reflection.GroovyClassValueFactory.<clinit> GoovyClassValueFactory.java:35)
	at org.codehaus.groovy.reflection.ClassInfo.<clinit>(ClassInfo.java:107)
 	at org.codehaus.groovy.reflection.ReflectionCache.getCachedClass(ReflectionCache.java:95)
	at org.codehaus.groovy.reflection.ReflectionCache.<clinit>(ReflectionCache.java:39)
	at    org.codehaus.groovy.runtime.metaclass.MetaClassRegistryImpl.registerMethods(MetaClassRegistryImpl.java:210)
	at org.codehaus.groovy.runtime.metaclass.MetaClassRegistryImpl.<init>  (MetaClassRegistryImpl.java:108)
	at org.codehaus.groovy.runtime.metaclass.MetaClassRegistryImpl.<init> (MetaClassRegistryImpl.java:86)
	at groovy.lang.GroovySystem.<clinit>(GroovySystem.java:36)
 	at org.springframework.beans.factory.groovy.GroovyBeanDefinitionReader.<init> (GroovyBeanDefinitionReader.java:150)
 	at org.springframework.boot.BeanDefinitionLoader.<init>(BeanDefinitionLoader.java:85)
 	at org.springframework.boot.SpringApplication.createBeanDefinitionLoader(SpringApplication.java:738)
	at org.springframework.boot.SpringApplication.load(SpringApplication.java:681)
	at org.springframework.boot.SpringApplication.prepareContext(SpringApplication.java:392)
	at org.springframework.boot.SpringApplication.run(SpringApplication.java:314)
 	at org.springframework.boot.SpringApplication.run(SpringApplication.java:1226)
 	at org.springframework.boot.SpringApplication.run(SpringApplication.java:1215)
	at com.baeldung.Application.main(Application.java:13)
web - 2021-04-24 18:40:33,725 [main] ERROR o.s.b.SpringApplication - Application run failed
j.l.NoClassDefFoundError: Could not initialize class org.codehaus.groovy.reflection.ReflectionCache
	at o.c.g.r.d.NumberNumberMetaMethod.<clinit>(NumberNumberMetaMethod.java:33)
	at j.i.r.NativeConstructorAccessorImpl.newInstance0(NativeConstructorAccessorImpl.java)
	at j.i.r.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:64)
 	at j.i.r.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
 	at j.l.r.Constructor.newInstanceWithCaller(Constructor.java:500)
	... 14 frames truncated

This bug exists due to the dependency "rest-assured", which has groovy as a dependency.

In Entities, You are using direct field access (instead of accessor)

I can see in Role.java you are doing this:

    public boolean equals(final Object obj) {
        --- Some Checks---
        final Role role = (Role) obj;
        if (!name.equals(role.name)) {
            return false;
        }
        return true;
    }

According to Hibernate conventions you shouldn't do it you should always call getter.

So you should do:

    public boolean equals(final Object obj) {
        --- Some Checks---
        final Role role = (Role) obj;
        if (!getName().equals(role.getName())) {
            return false;
        }
        return true;
    }

This is in referece to Proxy-Pitfalls-1:
https://xebia.com/blog/advanced-hibernate-proxy-pitfalls/

Since you are an expert. I want to know your opinion on this.

I have got configuration problem with the project

This is the log , i have tried to deploy the project on AWS Elastic BeanStalk but return only 404

26-Feb-2019 17:31:13.283 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Server number: 8.5.32.0
26-Feb-2019 17:31:13.283 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log OS Name: Linux
26-Feb-2019 17:31:13.284 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log OS Version: 4.14.97-74.72.amzn1.x86_64
26-Feb-2019 17:31:13.284 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Architecture: amd64
26-Feb-2019 17:31:13.284 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Java Home: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-0.42.amzn1.x86_64/jre
26-Feb-2019 17:31:13.284 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Version: 1.8.0_191-b12
26-Feb-2019 17:31:13.284 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Vendor: Oracle Corporation
26-Feb-2019 17:31:13.284 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log CATALINA_BASE: /usr/share/tomcat8
26-Feb-2019 17:31:13.284 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log CATALINA_HOME: /usr/share/tomcat8
26-Feb-2019 17:31:13.284 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent The APR based Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: [/usr/java/packages/lib/amd64:/usr/lib64:/lib64:/lib:/usr/lib]
26-Feb-2019 17:31:13.725 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["http-nio-8080"]
26-Feb-2019 17:31:13.777 INFO [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read
26-Feb-2019 17:31:13.808 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["ajp-nio-8009"]
26-Feb-2019 17:31:13.810 INFO [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read
26-Feb-2019 17:31:13.824 INFO [main] org.apache.catalina.startup.Catalina.load Initialization processed in 1967 ms
26-Feb-2019 17:31:13.925 INFO [main] org.apache.catalina.core.StandardService.startInternal Starting service [Catalina]
26-Feb-2019 17:31:13.930 INFO [main] org.apache.catalina.core.StandardEngine.startInternal Starting Servlet Engine: Apache Tomcat/8.5.32
26-Feb-2019 17:31:13.972 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [/var/lib/tomcat8/webapps/ROOT]
26-Feb-2019 17:31:19.605 INFO [localhost-startStop-1] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
26-Feb-2019 17:31:27.516 SEVERE [localhost-startStop-1] org.apache.catalina.core.ContainerBase.addChildInternal ContainerBase.addChild: start:
org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina].StandardHost[localhost].StandardContext[]]
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:167)
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:754)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:730)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:734)
at org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1140)
at org.apache.catalina.startup.HostConfig$DeployDirectory.run(HostConfig.java:1875)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'entityManagerFactory' defined in class path resource [org/baeldung/spring/PersistenceJPAConfig.class]: Invocation of init method failed; nested exception is org.hibernate.service.spi.ServiceException: Unable to create requested service [org.hibernate.engine.jdbc.env.spi.JdbcEnvironment]
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1699)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:573)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:495)
at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:317)
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:315)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:199)
at org.springframework.context.support.AbstractApplicationContext.getBean(AbstractApplicationContext.java:1089)
at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:859)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:550)
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:140)
at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:762)
at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:398)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:330)
at org.springframework.boot.web.servlet.support.SpringBootServletInitializer.run(SpringBootServletInitializer.java:157)
at org.springframework.boot.web.servlet.support.SpringBootServletInitializer.createRootApplicationContext(SpringBootServletInitializer.java:137)
at org.springframework.boot.web.servlet.support.SpringBootServletInitializer.onStartup(SpringBootServletInitializer.java:91)
at org.springframework.web.SpringServletContainerInitializer.onStartup(SpringServletContainerInitializer.java:172)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5245)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
... 10 more
Caused by: org.hibernate.service.spi.ServiceException: Unable to create requested service [org.hibernate.engine.jdbc.env.spi.JdbcEnvironment]
at org.hibernate.service.internal.AbstractServiceRegistryImpl.createService(AbstractServiceRegistryImpl.java:271)
at org.hibernate.service.internal.AbstractServiceRegistryImpl.initializeService(AbstractServiceRegistryImpl.java:233)
at org.hibernate.service.internal.AbstractServiceRegistryImpl.getService(AbstractServiceRegistryImpl.java:210)
at org.hibernate.engine.jdbc.internal.JdbcServicesImpl.configure(JdbcServicesImpl.java:51)
at org.hibernate.boot.registry.internal.StandardServiceRegistryImpl.configureService(StandardServiceRegistryImpl.java:94)
at org.hibernate.service.internal.AbstractServiceRegistryImpl.initializeService(AbstractServiceRegistryImpl.java:242)
at org.hibernate.service.internal.AbstractServiceRegistryImpl.getService(AbstractServiceRegistryImpl.java:210)
at org.hibernate.boot.model.process.spi.MetadataBuildingProcess.handleTypes(MetadataBuildingProcess.java:352)
at org.hibernate.boot.model.process.spi.MetadataBuildingProcess.complete(MetadataBuildingProcess.java:111)
at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.metadata(EntityManagerFactoryBuilderImpl.java:861)
at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.build(EntityManagerFactoryBuilderImpl.java:888)
at org.springframework.orm.jpa.vendor.SpringHibernateJpaPersistenceProvider.createContainerEntityManagerFactory(SpringHibernateJpaPersistenceProvider.java:57)
at org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean.createNativeEntityManagerFactory(LocalContainerEntityManagerFactoryBean.java:365)
at org.springframework.orm.jpa.AbstractEntityManagerFactoryBean.buildNativeEntityManagerFactory(AbstractEntityManagerFactoryBean.java:390)
at org.springframework.orm.jpa.AbstractEntityManagerFactoryBean.afterPropertiesSet(AbstractEntityManagerFactoryBean.java:377)
at org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean.afterPropertiesSet(LocalContainerEntityManagerFactoryBean.java:341)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1758)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1695)
... 29 more
Caused by: org.hibernate.HibernateException: Access to DialectResolutionInfo cannot be null when 'hibernate.dialect' not set
at org.hibernate.engine.jdbc.dialect.internal.DialectFactoryImpl.determineDialect(DialectFactoryImpl.java:100)
at org.hibernate.engine.jdbc.dialect.internal.DialectFactoryImpl.buildDialect(DialectFactoryImpl.java:54)
at org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator.initiateService(JdbcEnvironmentInitiator.java:137)
at org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator.initiateService(JdbcEnvironmentInitiator.java:35)
at org.hibernate.boot.registry.internal.StandardServiceRegistryImpl.initiateService(StandardServiceRegistryImpl.java:88)
at org.hibernate.service.internal.AbstractServiceRegistryImpl.createService(AbstractServiceRegistryImpl.java:259)
... 46 more

26-Feb-2019 17:31:27.525 SEVERE [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Error deploying web application directory [/var/lib/tomcat8/webapps/ROOT]
java.lang.IllegalStateException: ContainerBase.addChild: start: org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina].StandardHost[localhost].StandardContext[]]
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:758)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:730)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:734)
at org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1140)
at org.apache.catalina.startup.HostConfig$DeployDirectory.run(HostConfig.java:1875)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)

26-Feb-2019 17:31:27.526 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/var/lib/tomcat8/webapps/ROOT] has finished in [13,553] ms
26-Feb-2019 17:31:27.535 INFO [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler ["http-nio-8080"]
26-Feb-2019 17:31:27.564 INFO [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler ["ajp-nio-8009"]
26-Feb-2019 17:31:27.580 INFO [main] org.apache.catalina.startup.Catalina.start Server startup in 13755 ms

Encoded password does not look like BCrypt with inmemory authenticaiton using Bcrypt password encoder

This issue is still reproducible with Spring boot version 2.2.0 and Spring security 5.2.0 version with inmemory authentication.

 @Autowired
    public void configureGlobal(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
        authenticationManagerBuilder
                .inMemoryAuthentication()
                .withUser("hari")
                .password("welcome")
                .roles("USER")
                .and()
                .withUser("kiran")
                .password("testing")
                .roles("USER", "ADMIN")
                .and()
                .passwordEncoder(passwordEncoder());

  @Bean
    public BCryptPasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }

2019-11-03 19:10:50.962 WARN 14504 --- [nio-8080-exec-1] o.s.s.c.bcrypt.BCryptPasswordEncoder : Encoded password does not look like BCrypt

Originally posted by @prashdeep in #65 (comment)

Update the code in article spring-security-block-brute-force-authentication-attempts

Update code block in the following point -

Point 2 - An AuthenticationFailureEventListener. The code block does not match the repository.
Point 3 - An AuthenticationSuccessEventListener. The code block does not match the repository.

535 AUTH failed

Hi
I have been using the below data on email properties files
smtp.host=smtp-relay.gmail.com
smtp.port=587
smtp.protocol=smtps
smtp.username=[email protected]
smtp.password=mypassword
support.email=[email protected]

and getting the below exception

caused by: j.m.AuthenticationFailedException: 535 AUTH failed
at c.s.m.s.SMTPTransport$Authenticator.authenticate(SMTPTransport.java:932)
at c.s.m.s.SMTPTransport.authenticate(SMTPTransport.java:843)
at c.s.m.s.SMTPTransport.protocolConnect(SMTPTransport.java:748)
at j.m.Service.connect(Service.java:366)

I have tried all the other option of host for gmail with different port number and none of the options has worked.
Could you please provide a working properties value for gmail .smtp

Each time when event occurs, SetupDataLoader creates new admin

When hbm2ddl.auto=update SetupDataLoader creates new admin with the same details. Maybe there should be also method createUserIfNotFound?

When update all POM dependecies?

There are so old version in whole project

Why some table names are Upper Camer Case. And some are underscore case

This is not an issue, But more of a question.

Is there any particular reason why there are two conventions in the table names? I can see these names:

DeviceMetadata
PasswordResetToken
Privilege
Role
VerificationToken
hibernate_sequence
roles_privileges
user_account
users_roles

Is it a convention or you just didn't care to change the names?

Issue when parsing json with field exeption

When i try to check validation of firstName or lastName (I change @SiZe min = 2 in UserDto.java for firstName and lastName, this is the only way to check these fields validation), validation not working, because of such exeption in lines 125-126 in Registration.html (parsing object, not String):

VM52:1 Uncaught SyntaxError: Unexpected token s in JSON at position 0
    at JSON.parse (<anonymous>)
    at Function.m.parseJSON (jquery.min.js:4)
    at Object.<anonymous> (registration.html:125)
    at j (jquery.min.js:2)
    at Object.fireWith [as rejectWith] (jquery.min.js:2)
    at x (jquery.min.js:4)
    at XMLHttpRequest.b (jquery.min.js:4)

I saw, that problem is in GenericResponse.java which doesn't have the constructor with "fieldError" argument. Then i saw your other projects and found "The Registration API becomes RESTful" where was such constructor:

public GenericResponse(List<FieldError> fieldErrors, List<ObjectError> globalErrors) { }

Then i added it to my GenericResponse.java and also changed the signature of:

protected ResponseEntity<Object> handleBindException(final BindException ex, final HttpHeaders headers, final HttpStatus status, final WebRequest request) {
        logger.error("400 Status Code", ex);
        final BindingResult result = ex.getBindingResult();
        final GenericResponse bodyOfResponse = new GenericResponse(_result.getAllErrors(), "Invalid" + result.getObjectName());
        return handleExceptionInternal(ex, bodyOfResponse, new HttpHeaders(), HttpStatus.BAD_REQUEST, request);
    }

for:

protected ResponseEntity<Object> handleBindException
  (BindException ex, HttpHeaders headers, HttpStatus status, WebRequest request) {
    logger.error("400 Status Code", ex);
    BindingResult result = ex.getBindingResult();
    GenericResponse bodyOfResponse = 
      new GenericResponse(result.getFieldErrors(), result.getGlobalErrors());
     
    return handleExceptionInternal(
      ex, bodyOfResponse, new HttpHeaders(), HttpStatus.BAD_REQUEST, request);
}

Validation works great. But it shows only one warning message also when it has more ones. And i cant use messages_en.properties for changing warn messages texts.
Please help.

Encoded password does not look like BCrypt

Is it just me or has anyone else got an error like o.s.s.c.bcrypt.BCryptPasswordEncoder : Encoded password does not look like BCrypt?

public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
   @Autowired
    CustomUserDetailsService customUserDetailsService;
   .....
   @Bean
    public static PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(16);
    }
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.authenticationProvider(authenticationProvider());
    }
    @Bean
    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
        authenticationProvider.setUserDetailsService(customUserDetailsService);
        authenticationProvider.setPasswordEncoder(passwordEncoder());
        return authenticationProvider;
    }
}

Service:

@Autowired
    PasswordEncoder passwordEncoder;
user.setPassword(passwordEncoder.encode(user.getPassword()));

The encrypted password looks like $2a$16$AYSTH/JEPXPwqYBRswLq0emwmItvsQgf.dnaffXGJpvYML97bBoGe in the db, but when I try to log in, I get the error.
P.s.: I am using this with OAuth2 Spring boot 5.0.4.RELEASE

javax.mail.AuthenticationFailedException: 535 AUTH failed

Hi Team

I am getting the below exception after submitting the button on the registration page.

web - 2017-10-10 23:14:06,669 [tomcat-http--8] ERROR o.b.w.e.RestResponseEntityExceptionHandler - 500 Status Code
o.s.m.MailAuthenticationException: Authentication failed; nested exception is javax.mail.AuthenticationFailedException: 535 AUTH failed

at o.s.m.j.JavaMailSenderImpl.doSend(JavaMailSenderImpl.java:424)
at o.s.m.j.JavaMailSenderImpl.send(JavaMailSenderImpl.java:307)
at o.s.m.j.JavaMailSenderImpl.send(JavaMailSenderImpl.java:296)
at o.b.r.l.RegistrationListener.confirmRegistration(RegistrationListener.java:43)
at o.b.r.l.RegistrationListener.onApplicationEvent(RegistrationListener.java:34)
... 90 frames truncated

Caused by: j.m.AuthenticationFailedException: 535 AUTH failed

Below is the content of the email.properties file
spring.mail.properties.mail.host=smtp.gmail.com
spring.mail.properties.mail.username=[email protected]
spring.mail.properties.mail.password=********
spring.mail.properties.mail.port=465
spring.mail.properties.mail.smtp.auth=true
spring.mail.properties.mail.smtp.socketFactory.port=465
spring.mail.properties.mail.smtp.socketFactory.class=javax.net.ssl.SSLSocketFactory
spring.mail.properties.mail.smtp.socketFactory.fallback =false
spring.mail.properties.mail.smtp.ssl.enable=true
spring.mail.properties.mail.smtp.starttls.enable=true

Could you please help me to figure out to resolve this issue.

Exception encountered during context initialization -

OpenJDK 64-Bit Server VM warning: Options -Xverify:none and -noverify were deprecated in JDK 13 and will likely be removed in a future release.

. ____ _ __ _ _
/\ / ' __ _ () __ __ _ \ \ \
( ( )__ | '_ | '| | ' / ` | \ \ \
\/ )| |)| | | | | || (| | ) ) ) )
' || .__|| ||| |_, | / / / /
=========||==============|/=////
:: Spring Boot :: (v2.0.4.RELEASE)

web - 2020-02-18 21:23:52,835 [main] INFO o.b.Application - Starting Application on AIPL-PUN-LT206 with PID 4124 (D:\LearningNewTech\Spring\registration\spring-security-registration\target\classes started by mingle in D:\LearningNewTech\Spring\registration\spring-security-registration)
web - 2020-02-18 21:23:52,839 [main] DEBUG o.b.Application - Running with Spring Boot v2.0.4.RELEASE, Spring v5.0.8.RELEASE
web - 2020-02-18 21:23:52,842 [main] INFO o.b.Application - No active profile set, falling back to default profiles: default
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by org.codehaus.groovy.reflection.CachedClass (file:/D:/Users/mingle/.m2/repository/org/codehaus/groovy/groovy/2.4.15/groovy-2.4.15.jar) to method java.lang.Object.finalize()
WARNING: Please consider reporting this to the maintainers of org.codehaus.groovy.reflection.CachedClass
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
web - 2020-02-18 21:23:55,439 [main] INFO o.a.c.h.Http11NioProtocol - Initializing ProtocolHandler ["http-nio-8081"]
web - 2020-02-18 21:23:55,449 [main] INFO o.a.c.c.StandardService - Starting service [Tomcat]
web - 2020-02-18 21:23:55,450 [main] INFO o.a.c.c.StandardEngine - Starting Servlet Engine: Apache Tomcat/8.5.32
web - 2020-02-18 21:23:55,457 [localhost-startStop-1] INFO o.a.c.c.AprLifecycleListener - The APR based Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: [C:\Program Files\Java\bin;C:\Windows\Sun\Java\bin;C:\Windows\system32;C:\Windows;C:/Program Files/Java/bin/server;C:/Program Files/Java/bin;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0;C:\Windows\System32\OpenSSH;C:\Program Files\Intel\WiFi\bin;C:\Program Files\Common Files\Intel\WirelessCommon;C:\Program Files\PuTTY;C:\Program Files\Java\bin;;C:\Program Files\Microsoft VS Code\bin;C:\Program Files (x86)\nodejs;D:\Users\mingle\AppData\Local\Microsoft\WindowsApps;;D:\Users\mingle\Downloads\software\eclipse-jee-2019-12-R-win32-x86_64\eclipse;;.]
web - 2020-02-18 21:23:55,773 [localhost-startStop-1] INFO o.a.c.c.C.[.[.[/] - Initializing Spring embedded WebApplicationContext
web - 2020-02-18 21:23:55,946 [main] WARN o.s.b.w.s.c.AnnotationConfigServletWebServerApplicationContext - Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'entityManagerFactory' defined in class path resource [org/baeldung/spring/PersistenceJPAConfig.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean]: Factory method 'entityManagerFactory' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'dataSource' defined in class path resource [org/baeldung/spring/PersistenceJPAConfig.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.sql.DataSource]: Factory method 'dataSource' threw exception; nested exception is java.lang.IllegalStateException: Could not load JDBC driver class [org.h2.Driver]
web - 2020-02-18 21:23:55,949 [main] INFO o.a.c.c.StandardService - Stopping service [Tomcat]
web - 2020-02-18 21:23:56,010 [main] ERROR o.s.b.SpringApplication - Application run failed
o.s.b.f.BeanCreationException: Error creating bean with name 'entityManagerFactory' defined in class path resource [org/baeldung/spring/PersistenceJPAConfig.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean]: Factory method 'entityManagerFactory' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'dataSource' defined in class path resource [org/baeldung/spring/PersistenceJPAConfig.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.sql.DataSource]: Factory method 'dataSource' threw exception; nested exception is java.lang.IllegalStateException: Could not load JDBC driver class [org.h2.Driver]
at o.s.b.f.s.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:590)
at o.s.b.f.s.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1247)
at o.s.b.f.s.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1096)
at o.s.b.f.s.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:535)
at o.s.b.f.s.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:495)
... 14 frames truncated
Caused by: o.s.b.BeanInstantiationException: Failed to instantiate [org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean]: Factory method 'entityManagerFactory' threw exception; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'dataSource' defined in class path resource [org/baeldung/spring/PersistenceJPAConfig.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.sql.DataSource]: Factory method 'dataSource' threw exception; nested exception is java.lang.IllegalStateException: Could not load JDBC driver class [org.h2.Driver]
at o.s.b.f.s.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:185)
at o.s.b.f.s.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:582)
... 18 common frames omitted
Caused by: o.s.b.f.BeanCreationException: Error creating bean with name 'dataSource' defined in class path resource [org/baeldung/spring/PersistenceJPAConfig.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.sql.DataSource]: Factory method 'dataSource' threw exception; nested exception is java.lang.IllegalStateException: Could not load JDBC driver class [org.h2.Driver]
at o.s.b.f.s.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:590)
at o.s.b.f.s.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1247)
at o.s.b.f.s.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1096)
at o.s.b.f.s.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:535)
at o.s.b.f.s.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:495)
... 18 frames truncated
... 19 common frames omitted
Caused by: o.s.b.BeanInstantiationException: Failed to instantiate [javax.sql.DataSource]: Factory method 'dataSource' threw exception; nested exception is java.lang.IllegalStateException: Could not load JDBC driver class [org.h2.Driver]
at o.s.b.f.s.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:185)
at o.s.b.f.s.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:582)
... 41 common frames omitted
Caused by: j.l.IllegalStateException: Could not load JDBC driver class [org.h2.Driver]
at o.s.j.d.DriverManagerDataSource.setDriverClassName(DriverManagerDataSource.java:130)
at o.b.s.PersistenceJPAConfig.dataSource(PersistenceJPAConfig.java:51)
at o.b.s.PersistenceJPAConfig$$EnhancerBySpringCGLIB$$b1ec8e82.CGLIB$dataSource$2()
at o.b.s.PersistenceJPAConfig$$EnhancerBySpringCGLIB$$b1ec8e82$$FastClassBySpringCGLIB$$86573e62.invoke()
at o.s.c.p.MethodProxy.invokeSuper(MethodProxy.java:228)
... 7 frames truncated
... 42 common frames omitted
Caused by: j.l.ClassNotFoundException: org.h2.Driver
at j.i.l.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:604)
at j.i.l.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
at j.l.ClassLoader.loadClass(ClassLoader.java:521)
at j.l.Class.forName0(Class.java)
at j.l.Class.forName(Class.java:416)
... 1 frames truncated
... 53 common frames omitted

Incorrect form action link?

I've noticed that registration.html has a form with an action URL of /. Shouldn't this be /user/registration?

I've tried to incorporate the registration flow in a demo and the form post ended up nowhere since no controller was listening for POSTs on /.

Data Base Schema is missing

Could you please provide Data base script for this project

Do I need to install MySQL to run this application?

Hi,

From README.md, it seems like I need to install MySQL locally to run this application. Where can I find the database scripts to create tables that are being used in the application? Also, this property in persistence.properties has createDatabaseIfNotExist parameter. What is it doing?
jdbc.url=jdbc:mysql://localhost:3306/registration_02?createDatabaseIfNotExist=true

Any help appreciated.

Database password security

How can we protect the database password stored in persistence.properties.

after registration login is not working

Invalid Credentials issue after login

AuthenticationFailureListener and AuthenticationSuccessEventListener should use X-Forwarded-For address

Problem: the AuthenticationFailureListener and AuthenticationSuccessEventListener use the WebAuthenticationDetails, which in turn uses this.remoteAddress = request.getRemoteAddr();

According to the article , in cases of proxies, the X-Forwarded-For should be used. It might be a corner case, but as long as MyUserDetailsService.java uses X-Forwarded-For, there should be some consistency.

Otherwise, the last IP will be blocked and MyUserDetailsService will retrieve the IP from X-Forwarded-For and the solution won't work as expected.

Login form submits to unexisting action

After entering user/pass on login page (http://localhost:8081/login or http://localhost:8081/customLogin) and submitting form, user is presented with empty page.
Response for this request is 405, in the Java log I can see "Request method 'POST' not supported"

Downloaded latest code from the master branch, changed config to use mysql, disabled H2, registered few test users.

The address 0:0:0:0:0:0:0:1 is not in the database.

I was able to successfully register using Gmail account. I could successfully complete the verification process which have set USER_ACCOUNT.ENABLED to 1 against my user account row in database.

But now when I try to login, I get following exception

Build issue

Hello
I try to run the app but i get these : (added hibernate dependencies but didn't fix it)
I'm newbie in spring :)

web - 2018-07-24 15:42:27,177 [main] INFO o.b.Application - Starting Application v1.0.1-SNAPSHOT on elieot with PID 15532 (C:\Users\NPS\Desktop\E\E2\spring-security-registration-master\target\spring-security
-login-and-registration.war started by NPS in C:\Users\NPS\Desktop\E\E2\spring-security-registration-master\target)
web - 2018-07-24 15:42:27,182 [main] DEBUG o.b.Application - Running with Spring Boot v1.5.1.RELEASE, Spring v4.3.6.RELEASE
web - 2018-07-24 15:42:27,182 [main] INFO o.b.Application - No active profile set, falling back to default profiles: default
WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by org.codehaus.groovy.reflection.CachedClass$3$1 (jar:file:/C:/Users/NPS/Desktop/E/E2/spring-security-registration-master/target/spring-security-login-and-registration.war!/WEB-IN
F/lib/groovy-2.4.7.jar!/) to method java.lang.Object.finalize()
WARNING: Please consider reporting this to the maintainers of org.codehaus.groovy.reflection.CachedClass$3$1
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
web - 2018-07-24 15:42:27,907 [background-preinit] INFO o.h.v.i.u.Version - HV000001: Hibernate Validator 5.3.4.Final
web - 2018-07-24 15:42:29,772 [main] WARN o.h.v.m.ParameterMessageInterpolator - HV000184: ParameterMessageInterpolator has been chosen, EL interpolation will not be supported
web - 2018-07-24 15:42:29,952 [main] WARN o.h.v.m.ParameterMessageInterpolator - HV000184: ParameterMessageInterpolator has been chosen, EL interpolation will not be supported
web - 2018-07-24 15:42:30,390 [main] INFO o.a.c.c.StandardService - Starting service Tomcat
web - 2018-07-24 15:42:30,391 [main] INFO o.a.c.c.StandardEngine - Starting Servlet Engine: Apache Tomcat/8.5.11
web - 2018-07-24 15:42:31,717 [localhost-startStop-1] INFO o.a.c.c.C.[.[.[/] - Initializing Spring embedded WebApplicationContext
web - 2018-07-24 15:42:32,065 [main] INFO o.h.j.i.u.LogHelper - HHH000204: Processing PersistenceUnitInfo [
name: default
...]
web - 2018-07-24 15:42:32,180 [main] INFO o.h.Version - HHH000412: Hibernate Core {5.3.2.Final}
web - 2018-07-24 15:42:32,182 [main] INFO o.h.c.Environment - HHH000206: hibernate.properties not found
web - 2018-07-24 15:42:32,271 [main] WARN o.s.b.c.e.AnnotationConfigEmbeddedWebApplicationContext - Exception encountered during context initialization - cancelling refresh attempt: org.springframework.beans.factor
y.BeanCreationException: Error creating bean with name 'entityManagerFactory' defined in class path resource [org/baeldung/spring/PersistenceJPAConfig.class]: Invocation of init method failed; nested exception is ja
va.lang.NoClassDefFoundError: javax/xml/bind/JAXBException
web - 2018-07-24 15:42:32,276 [main] WARN o.s.b.SpringApplication - Error handling failed (Error creating bean with name 'delegatingApplicationListener' defined in class path resource [org/springframework/security/
config/annotation/web/configuration/WebSecurityConfiguration.class]: BeanPostProcessor before instantiation of bean failed; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating
bean with name 'org.springframework.transaction.annotation.ProxyTransactionManagementConfiguration': Initialization of bean failed; nested exception is org.springframework.beans.factory.NoSuchBeanDefinitionExceptio
n: No bean named 'org.springframework.context.annotation.ConfigurationClassPostProcessor.importRegistry' available)
web - 2018-07-24 15:42:32,283 [main] ERROR o.s.b.SpringApplication - Application startup failed
o.s.b.f.BeanCreationException: Error creating bean with name 'entityManagerFactory' defined in class path resource [org/baeldung/spring/PersistenceJPAConfig.class]: Invocation of init method failed; nested exception
is java.lang.NoClassDefFoundError: javax/xml/bind/JAXBException
at o.s.b.f.s.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1628)
at o.s.b.f.s.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:555)
at o.s.b.f.s.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:483)
at o.s.b.f.s.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:306)
at o.s.b.f.s.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
... 20 frames truncated
Caused by: j.l.NoClassDefFoundError: javax/xml/bind/JAXBException
at o.h.b.s.XmlMappingBinderAccess.(XmlMappingBinderAccess.java:43)
at o.h.b.MetadataSources.(MetadataSources.java:86)
at o.h.j.b.i.EntityManagerFactoryBuilderImpl.(EntityManagerFactoryBuilderImpl.java:212)
at o.h.j.b.i.EntityManagerFactoryBuilderImpl.(EntityManagerFactoryBuilderImpl.java:167)
at o.s.o.j.v.SpringHibernateJpaPersistenceProvider.createContainerEntityManagerFactory(SpringHibernateJpaPersistenceProvider.java:54)
... 5 frames truncated
... 24 common frames omitted
Caused by: j.l.ClassNotFoundException: javax.xml.bind.JAXBException
at j.n.URLClassLoader.findClass(Unknown Source)
at j.l.ClassLoader.loadClass(Unknown Source)
at o.s.b.l.LaunchedURLClassLoader.loadClass(LaunchedURLClassLoader.java:94)
at j.l.ClassLoader.loadClass(Unknown Source)
... 34 common frames omitted

Account enumeration

As I see it, this example responds with the msg "An account for that username/email already exists. Please enter a different username." on the page if the username and/or email is already taken. That would be an account enumeration vulnerability. Did you plan to leave this out of scope?

Best practice would be to always accept the registration-form input and use the confirmation email sent to communicate things like double-registration. A user can then be notified with a custom "Someone tried to register an account on this mail-address, but there is already an account" with things like IP, date/time etc. to help investigate possible mis-use / hacking attempt.

Problem to deploy the project on aws

I have tried to deploy it on tomcat application server on elastic Beanstalk with Amazon services. When I try to open the link where host the application return only 404 page. Looking the logs I have seen this stacktrace error. Running it on eclipse with embedded tomcat 8.5 work perfectly.
Refer to spring-security-registration project

his is the log , i have tried to deploy the project on AWS Elastic BeanStalk but return only 404
26-Feb-2019 17:31:13.283 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Server number: 8.5.32.0
26-Feb-2019 17:31:13.283 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log OS Name: Linux
26-Feb-2019 17:31:13.284 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log OS Version: 4.14.97-74.72.amzn1.x86_64
26-Feb-2019 17:31:13.284 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Architecture: amd64
26-Feb-2019 17:31:13.284 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Java Home: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-0.42.amzn1.x86_64/jre
26-Feb-2019 17:31:13.284 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Version: 1.8.0_191-b12
26-Feb-2019 17:31:13.284 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Vendor: Oracle Corporation
26-Feb-2019 17:31:13.284 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log CATALINA_BASE: /usr/share/tomcat8
26-Feb-2019 17:31:13.284 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log CATALINA_HOME: /usr/share/tomcat8
26-Feb-2019 17:31:13.284 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent The APR based Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: [/usr/java/packages/lib/amd64:/usr/lib64:/lib64:/lib:/usr/lib]
26-Feb-2019 17:31:13.725 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["http-nio-8080"]
26-Feb-2019 17:31:13.777 INFO [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read
26-Feb-2019 17:31:13.808 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["ajp-nio-8009"]
26-Feb-2019 17:31:13.810 INFO [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read
26-Feb-2019 17:31:13.824 INFO [main] org.apache.catalina.startup.Catalina.load Initialization processed in 1967 ms
26-Feb-2019 17:31:13.925 INFO [main] org.apache.catalina.core.StandardService.startInternal Starting service [Catalina]
26-Feb-2019 17:31:13.930 INFO [main] org.apache.catalina.core.StandardEngine.startInternal Starting Servlet Engine: Apache Tomcat/8.5.32
26-Feb-2019 17:31:13.972 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [/var/lib/tomcat8/webapps/ROOT]
26-Feb-2019 17:31:19.605 INFO [localhost-startStop-1] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.
26-Feb-2019 17:31:27.516 SEVERE [localhost-startStop-1] org.apache.catalina.core.ContainerBase.addChildInternal ContainerBase.addChild: start:
org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina].StandardHost[localhost].StandardContext[]]
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:167)
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:754)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:730)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:734)
at org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1140)
at org.apache.catalina.startup.HostConfig$DeployDirectory.run(HostConfig.java:1875)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'entityManagerFactory' defined in class path resource [org/baeldung/spring/PersistenceJPAConfig.class]: Invocation of init method failed; nested exception is org.hibernate.service.spi.ServiceException: Unable to create requested service [org.hibernate.engine.jdbc.env.spi.JdbcEnvironment]
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1699)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:573)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:495)
at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:317)
at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:315)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:199)
at org.springframework.context.support.AbstractApplicationContext.getBean(AbstractApplicationContext.java:1089)
at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:859)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:550)
at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:140)
at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:762)
at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:398)
at org.springframework.boot.SpringApplication.run(SpringApplication.java:330)
at org.springframework.boot.web.servlet.support.SpringBootServletInitializer.run(SpringBootServletInitializer.java:157)
at org.springframework.boot.web.servlet.support.SpringBootServletInitializer.createRootApplicationContext(SpringBootServletInitializer.java:137)
at org.springframework.boot.web.servlet.support.SpringBootServletInitializer.onStartup(SpringBootServletInitializer.java:91)
at org.springframework.web.SpringServletContainerInitializer.onStartup(SpringServletContainerInitializer.java:172)
at org.apache.catalina.core.StandardContext.startInternal(StandardContext.java:5245)
at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150)
... 10 more
Caused by: org.hibernate.service.spi.ServiceException: Unable to create requested service [org.hibernate.engine.jdbc.env.spi.JdbcEnvironment]
at org.hibernate.service.internal.AbstractServiceRegistryImpl.createService(AbstractServiceRegistryImpl.java:271)
at org.hibernate.service.internal.AbstractServiceRegistryImpl.initializeService(AbstractServiceRegistryImpl.java:233)
at org.hibernate.service.internal.AbstractServiceRegistryImpl.getService(AbstractServiceRegistryImpl.java:210)
at org.hibernate.engine.jdbc.internal.JdbcServicesImpl.configure(JdbcServicesImpl.java:51)
at org.hibernate.boot.registry.internal.StandardServiceRegistryImpl.configureService(StandardServiceRegistryImpl.java:94)
at org.hibernate.service.internal.AbstractServiceRegistryImpl.initializeService(AbstractServiceRegistryImpl.java:242)
at org.hibernate.service.internal.AbstractServiceRegistryImpl.getService(AbstractServiceRegistryImpl.java:210)
at org.hibernate.boot.model.process.spi.MetadataBuildingProcess.handleTypes(MetadataBuildingProcess.java:352)
at org.hibernate.boot.model.process.spi.MetadataBuildingProcess.complete(MetadataBuildingProcess.java:111)
at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.metadata(EntityManagerFactoryBuilderImpl.java:861)
at org.hibernate.jpa.boot.internal.EntityManagerFactoryBuilderImpl.build(EntityManagerFactoryBuilderImpl.java:888)
at org.springframework.orm.jpa.vendor.SpringHibernateJpaPersistenceProvider.createContainerEntityManagerFactory(SpringHibernateJpaPersistenceProvider.java:57)
at org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean.createNativeEntityManagerFactory(LocalContainerEntityManagerFactoryBean.java:365)
at org.springframework.orm.jpa.AbstractEntityManagerFactoryBean.buildNativeEntityManagerFactory(AbstractEntityManagerFactoryBean.java:390)
at org.springframework.orm.jpa.AbstractEntityManagerFactoryBean.afterPropertiesSet(AbstractEntityManagerFactoryBean.java:377)
at org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean.afterPropertiesSet(LocalContainerEntityManagerFactoryBean.java:341)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.invokeInitMethods(AbstractAutowireCapableBeanFactory.java:1758)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1695)
... 29 more
Caused by: org.hibernate.HibernateException: Access to DialectResolutionInfo cannot be null when 'hibernate.dialect' not set
at org.hibernate.engine.jdbc.dialect.internal.DialectFactoryImpl.determineDialect(DialectFactoryImpl.java:100)
at org.hibernate.engine.jdbc.dialect.internal.DialectFactoryImpl.buildDialect(DialectFactoryImpl.java:54)
at org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator.initiateService(JdbcEnvironmentInitiator.java:137)
at org.hibernate.engine.jdbc.env.internal.JdbcEnvironmentInitiator.initiateService(JdbcEnvironmentInitiator.java:35)
at org.hibernate.boot.registry.internal.StandardServiceRegistryImpl.initiateService(StandardServiceRegistryImpl.java:88)
at org.hibernate.service.internal.AbstractServiceRegistryImpl.createService(AbstractServiceRegistryImpl.java:259)
... 46 more
26-Feb-2019 17:31:27.525 SEVERE [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Error deploying web application directory [/var/lib/tomcat8/webapps/ROOT]
java.lang.IllegalStateException: ContainerBase.addChild: start: org.apache.catalina.LifecycleException: Failed to start component [StandardEngine[Catalina].StandardHost[localhost].StandardContext[]]
at org.apache.catalina.core.ContainerBase.addChildInternal(ContainerBase.java:758)
at org.apache.catalina.core.ContainerBase.addChild(ContainerBase.java:730)
at org.apache.catalina.core.StandardHost.addChild(StandardHost.java:734)
at org.apache.catalina.startup.HostConfig.deployDirectory(HostConfig.java:1140)
at org.apache.catalina.startup.HostConfig$DeployDirectory.run(HostConfig.java:1875)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
26-Feb-2019 17:31:27.526 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/var/lib/tomcat8/webapps/ROOT] has finished in [13,553] ms
26-Feb-2019 17:31:27.535 INFO [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler ["http-nio-8080"]
26-Feb-2019 17:31:27.564 INFO [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler ["ajp-nio-8009"]
26-Feb-2019 17:31:27.580 INFO [main] org.apache.catalina.startup.Catalina.start Server startup in 13755 ms

What is the license for this project?

What is the license for this project?
May I use it in my own non GPL project?

better way to access h2 endpoint in dev profile

in SecSecurityConfig.java .headers().frameOptions().disable(); is not a very good sample,which will reduce system security .there is a better way i found on the internet https://dzone.com/articles/using-the-h2-database-console-in-spring-boot-with [COMMENT from Rob Winch]

Thanks for the write up. It seems it would be quite a bit easier & secure to use security.ignored=/console/** along with a profile. This way users don't accidentally have CSRF and the security headers disabled in production. See https://github.com/rwinch/spring-security-sample/tree/h2-console (note the h2-console branch) for a complete example.

About security : HTTP 2 instead of HTTP 1.1

How its possible to implement the http2 protocol in the current project?

Bootstrap and static folder

HI there,

currently I try to apply a html theme with elements located in the "static" folder and with bootstrap and jquery from de maven.
On other project it works perfectly, there it does not load ... even with this line of code:

 <link th:href="@{/webjars/bootstrap/3.3.6/css/bootstrap.min.css}" rel="stylesheet" media="screen" />
  <link type="text/css" th:href="@{/css/style.default.css}" rel="stylesheet" media="screen"/>

How I fix it ?
thank you in advance

Shouldn't ROLE_ be returned in MyUserDetailsService.getAuthorities

My knowledge is a little sketchy as far as Spring Security goes but looking at https://github.com/Baeldung/spring-security-registration/blob/master/src/main/java/org/baeldung/security/MyUserDetailsService.java#L63 wouldn't it be better if the corresponding user's ROLE_XXX is added to the returned list of GrantedAuthority?

ie.

For ROLE_ADMIN a collection containing:

WRITE_PRIVILEGE, READ_PRIVILEGE, CHANGE_PASSWORD_PRIVILEGE, ROLE_ADMIN would be returned

For ROLE_USER a collection containing:

READ_PRIVILEGE, CHANGE_PASSWORD_PRIVILEGE, ROLE_ADMIN would be returned

That way both hasAuthority and hasRole would be usable. At the moment the latter prefixes ROLE_ to any PRIVILEGE check.

How does spring make Autowiring HttpServletRequest inside a singleton thread-safe?

Hey guys,

Is it thread-safe (how does it work) to @Autowired the HttpServletRequest inside a CaptchaService that is a singleton and not request-scoped bean?

spring-security-registration/src/main/java/org/baeldung/captcha/CaptchaService.java

Line 22 in 813d381

private HttpServletRequest request;

What happens when there are multiple requests using the CaptchaService at the same time. Wouldn't introduction of HttpServletRequest cause the CaptchaService to become stateful?

I did some googling and came across this stackoverlfow question that states it's thread-safe without providing enough information or supporting documentation and then there is the experts-exchange where this is discussed without any conclusion.

Would be nice to hear from the author or anyone with more expertise in the subject matter. Curious how does spring make the @Autowired private HttpServletRequest thread-safe inside a singleton bean?

Thanks,