diff --git a/gateway/src/main/java/org/georchestra/gateway/autoconfigure/app/CustomErrorAttributes.java b/gateway/src/main/java/org/georchestra/gateway/autoconfigure/app/CustomErrorAttributes.java index 5880ecb0..dcae1733 100644 --- a/gateway/src/main/java/org/georchestra/gateway/autoconfigure/app/CustomErrorAttributes.java +++ b/gateway/src/main/java/org/georchestra/gateway/autoconfigure/app/CustomErrorAttributes.java @@ -28,6 +28,7 @@ import org.springframework.boot.web.reactive.error.ErrorAttributes; import org.springframework.boot.web.reactive.error.ErrorWebExceptionHandler; import org.springframework.http.HttpStatus; +import org.springframework.security.access.AccessDeniedException; import org.springframework.web.reactive.function.server.ServerRequest; /** @@ -55,6 +56,9 @@ public Map getErrorAttributes(ServerRequest request, ErrorAttrib if (error instanceof UnknownHostException || error instanceof ConnectException) { attributes.put("status", HttpStatus.SERVICE_UNAVAILABLE.value()); attributes.put("error", HttpStatus.SERVICE_UNAVAILABLE.getReasonPhrase()); + } else if (error instanceof AccessDeniedException) { + attributes.put("status", HttpStatus.FORBIDDEN.value()); + attributes.put("error", HttpStatus.FORBIDDEN.getReasonPhrase()); } return attributes; } diff --git a/gateway/src/main/java/org/georchestra/gateway/security/CustomAccessDeniedHandler.java b/gateway/src/main/java/org/georchestra/gateway/security/CustomAccessDeniedHandler.java new file mode 100644 index 00000000..fd018e9f --- /dev/null +++ b/gateway/src/main/java/org/georchestra/gateway/security/CustomAccessDeniedHandler.java @@ -0,0 +1,15 @@ +package org.georchestra.gateway.security; + +import org.springframework.http.HttpStatus; +import org.springframework.security.access.AccessDeniedException; +import org.springframework.security.web.server.authorization.ServerAccessDeniedHandler; +import org.springframework.web.server.ServerWebExchange; +import reactor.core.publisher.Mono; + +public class CustomAccessDeniedHandler implements ServerAccessDeniedHandler { + + @Override + public Mono handle(ServerWebExchange serverWebExchange, AccessDeniedException accessDeniedException) { + throw new AccessDeniedException(HttpStatus.FORBIDDEN.name()); + } +} \ No newline at end of file diff --git a/gateway/src/main/java/org/georchestra/gateway/security/GatewaySecurityConfiguration.java b/gateway/src/main/java/org/georchestra/gateway/security/GatewaySecurityConfiguration.java index a5d77d16..4f8cd014 100644 --- a/gateway/src/main/java/org/georchestra/gateway/security/GatewaySecurityConfiguration.java +++ b/gateway/src/main/java/org/georchestra/gateway/security/GatewaySecurityConfiguration.java @@ -32,8 +32,6 @@ import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity; import org.springframework.security.config.web.server.ServerHttpSecurity; import org.springframework.security.config.web.server.ServerHttpSecurity.LogoutSpec; -import org.springframework.security.oauth2.client.oidc.web.server.logout.OidcClientInitiatedServerLogoutSuccessHandler; -import org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler; import org.springframework.security.web.server.SecurityWebFilterChain; import org.springframework.security.web.server.authentication.logout.RedirectServerLogoutSuccessHandler; import org.springframework.security.web.server.authentication.logout.ServerLogoutSuccessHandler; @@ -83,7 +81,7 @@ SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http, // disable CSRF protection, considering it will be managed // by proxified webapps, not the gateway. - http.csrf().disable(); + http.csrf().disable().exceptionHandling().accessDeniedHandler(new CustomAccessDeniedHandler()); http.formLogin() .authenticationFailureHandler(new ExtendedRedirectServerAuthenticationFailureHandler("login?error")) diff --git a/gateway/src/main/resources/templates/error/403.html b/gateway/src/main/resources/templates/error/403.html new file mode 100644 index 00000000..09a00b88 --- /dev/null +++ b/gateway/src/main/resources/templates/error/403.html @@ -0,0 +1,39 @@ + + + + + + + + Access forbidden + + + +
+ geOrchestra +

Sorry, access to this page is forbidden. Return to the homepage.

+
+ + \ No newline at end of file diff --git a/gateway/src/main/resources/templates/error/404.html b/gateway/src/main/resources/templates/error/404.html new file mode 100644 index 00000000..fbd76a6e --- /dev/null +++ b/gateway/src/main/resources/templates/error/404.html @@ -0,0 +1,39 @@ + + + + + + + + Page not found + + + +
+ geOrchestra +

Page not found. Return to the homepage.

+
+ + \ No newline at end of file diff --git a/gateway/src/main/resources/templates/error/500.html b/gateway/src/main/resources/templates/error/500.html new file mode 100644 index 00000000..68dd4d3a --- /dev/null +++ b/gateway/src/main/resources/templates/error/500.html @@ -0,0 +1,46 @@ + + + + + + + + Site in maintenance + + + +
+ geOrchestra +

+ Due to maintenance, this service is temporarily unavailable. +

+

We're sorry for the inconvenience !

+

Hint: do not close the tab - the requested page will show up in a few seconds.

+
+ + + \ No newline at end of file diff --git a/gateway/src/main/resources/templates/error/501.html b/gateway/src/main/resources/templates/error/501.html new file mode 100644 index 00000000..68dd4d3a --- /dev/null +++ b/gateway/src/main/resources/templates/error/501.html @@ -0,0 +1,46 @@ + + + + + + + + Site in maintenance + + + +
+ geOrchestra +

+ Due to maintenance, this service is temporarily unavailable. +

+

We're sorry for the inconvenience !

+

Hint: do not close the tab - the requested page will show up in a few seconds.

+
+ + + \ No newline at end of file diff --git a/gateway/src/main/resources/templates/error/503.html b/gateway/src/main/resources/templates/error/503.html new file mode 100644 index 00000000..68dd4d3a --- /dev/null +++ b/gateway/src/main/resources/templates/error/503.html @@ -0,0 +1,46 @@ + + + + + + + + Site in maintenance + + + +
+ geOrchestra +

+ Due to maintenance, this service is temporarily unavailable. +

+

We're sorry for the inconvenience !

+

Hint: do not close the tab - the requested page will show up in a few seconds.

+
+ + + \ No newline at end of file