Kotlin – integrate Spring Security & H2 Database

#kotlin #springboot #security

https://grokonez.com/spring-framework/spring-boot/kotlin-spring-boot/kotlin-integrate-spring-security-h2-database

In the past post, We had set-up a Kotlin SpringBoot project to develop with H2 database. But if you enable Spring Security in your project, the H2 database console will be blocked with 403 error. So in the tutorial, we will show you how to make configuration for resolving the Access Denied problem.

I. Technologies

– Kotlin 1.2.20
– Apache Maven 3.5.2
– Spring Tool Suite – Version 3.9.0.RELEASE
– Spring Boot – 1.5.10.RELEASE

H2 database – Bootstrap
II. Goal

1. Problem
If your project uses H2 database to develop and also enable Spring Security, then when accessing to H2 console path: '/h2_console', an error Access Denied Page will be thrown.

Why?
-> By default, Spring Security will block '/h2_console' path of H2 database.

2. Resolve

Solution is a simple configuration with Spring Security as below segment code:


@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
        ...
        
    http.csrf().disable();
    http.headers().frameOptions().disable();

http.csrf().disable(): disable CRSF.
http.headers().frameOptions().disable(): H2 database console runs inside a frame, So we need to disable X-Frame-Options in Spring Security.

3. Goal

We create a Kotlin SpringBoot as below structure:

Make a request to access H2’s console: 'http://localhost:8080/h2_console'

-> It will redirect to Login page.

-> Sign out

Again, make the request to access H2’s console: 'http://localhost:8080/h2_console', then login with user: 'admin/admin', it will redirect to H2’s login page: