Defer authentication to controller layer spring-security - spring-security

Question

I am developing a RestAPI with SpringBoot and Spring Security. The login end point is POST /session. Can I defer authentication to controller layer like below:
#Configuration(proxyBeanMethods = false)
#EnableWebSecurity(debug = true)
public class AppSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
#Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()).and()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.ALWAYS).and()
.formLogin().disable()
.httpBasic().disable()
.requestCache().disable()
.logout().disable()
.authorizeRequests()
.antMatchers(HttpMethod.POST,"/session").permitAll()
.anyRequest().authenticated();
}
#Bean
#Override
public AuthenticationManager authenticationManagerBean() throws Exception {
return super.authenticationManagerBean();
}
}
And in Controller:
#RestController
#RequestMapping("/session")
public class SessionController {
private final AuthenticationManager authenticationManager;
#Autowired
public SessionController(AuthenticationManager authenticationManager) {
this.authenticationManager = authenticationManager;
}
#PostMapping
public ResponseEntity create(#RequestBody #Validated LoginDTO loginDTO){
UsernamePasswordAuthenticationToken authRequest = new UsernamePasswordAuthenticationToken(
loginDTO.getUserName().trim(), loginDTO.getPassword());
final Authentication authentication = authenticationManager.authenticate(authRequest);
SecurityContextHolder.getContext().setAuthentication(authentication);
return ResponseEntity.ok().build();
}
}
Is it bad practice to do authentication like above?

Answer 1

There's nothing inherently wrong with using Spring MVC to handle login. The reason that Spring Security uses a filter is so that it can work in projects that aren't using Spring MVC.
That said, Spring Security's AbstractAuthenticationProcessingFilter does a few other things, too. For example, it protects against Session Fixation by changing the session id, and it changes out the CSRF token assigned to that session. If you have your controller do authentication, you'll likely want it to do those other things, too.
If you don't have a technical need to use Spring MVC, I'd still recommend relying on Spring Security to perform the login so as to not lose those other protections.
Side Note
Regardless of what you do, note that when you override the HttpSecurity method, you don't need to disable httpBasic nor formLogin as those are not turned on by default.