Styjun

What does it mean to describe someone as a butt steak?

How to format long polynomial?

What is a clear way to write a bar that has an extra beat?

Client team has low performances and low technical skills: we always fix their work and now they stop collaborate with us. How to solve?

Can you really stack all of this on an Opportunity Attack?

If human space travel is limited by the G force vulnerability, is there a way to counter G forces?

What defenses are there against being summoned by the Gate spell?

Can I ask the recruiters in my resume to put the reason why I am rejected?

How is the claim "I am in New York only if I am in America" the same as "If I am in New York, then I am in America?

Does an object always see its latest internal state irrespective of thread?

Rock identification in KY

Could an aircraft fly or hover using only jets of compressed air?

Why doesn't Newton's third law mean a person bounces back to where they started when they hit the ground?

How do I deal with an unproductive colleague in a small company?

Languages that we cannot (dis)prove to be Context-Free

Character reincarnated...as a snail

Why is Minecraft giving an OpenGL error?

meaning of に in 本当に?

Why does Kotter return in Welcome Back Kotter?

Can a vampire attack twice with their claws using Multiattack?

What's the point of deactivating Num Lock on login screens?

strTok function (thread safe, supports empty tokens, doesn't change string)

Codimension of non-flat locus

How to determine what difficulty is right for the game?

Session sharing Reactjs and JSP / Spring Security

How do servlets work? Instantiation, sessions, shared variables and multithreadingHow to avoid Java code in JSP files?What's the difference between @Component, @Repository & @Service annotations in Spring?sharing session attribute between two subdomains in tomcatHow long is Spring temporary CSRF token expiration time?Spring social ProviderSignInController creates a session whereas we are using oauth2Filter ordering with spring security and spring bootSpring Security and Session in RedisSpring Security .permitAll() no longer effective after upgrading to Spring Boot 2.0.2oAuth2 workflow on Spring Security for Stateless Web services using JWT or likewise?

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

0

I am a novice in Spring Security, but trying to figure how to handle the situation I have -

1. I have a site hosted at bigmonolithjavaapp.example.com - this is a big java app, with spring security and jsp's.




2. We are in the process of creating a new site based on reactjs that we want to embed as a page in the java JSP app. The reactjs site will be hosted at say - reactjs.example.com.

We need the reactjs.example.com to be able to access the bigmonolithjavaapp.example.com/api endpoint to share the same backend APIs. These endpoints are protected by spring security and because of that when I try to call the bigmonolithjavaapp.example.com/api endpoint from the reactjs.example.com pages, I am being redirected to the login page as there is no session sharing between these 2 domains.

Is there a way to extend the spring security session between both the domains?

To add to the mix, I have another restriction that I cannot change the document.domain on the pages for the bigmonolithjavaapp.example.com as there is a lot of business logic that happens on the page depending on the subdomain.

I see that there is CSRF Tokens, JSESSIONID (HttpOnly) and a bunch of other cookies in use today for the bigmonolithjavaapp.example.com

Is there a pattern or example on how to achieve this integration?

Update:
As I am reading more through the internet, I am now starting to think if JWT is a good fit for this or not?

1. User comes into bigmonolithjavaapp.example.com and authenticates himself.


2. User navigates to bigmonolithjavaapp.example.com/coolpage.html where I can embed the reactjs.example.com?token=<jwt_token> in an iframe.


3. 
   reactjs.example.com can use the jwt token to access the secured api resources from bigmonolithjavaapp.example.com.

Does this approach sound valid?

java spring reactjs spring-security jwt

share|improve this question

edited Mar 22 at 0:03

Satya

asked Mar 21 at 22:24

SatyaSatya

4731021

add a comment | 

0

I am a novice in Spring Security, but trying to figure how to handle the situation I have -

1. I have a site hosted at bigmonolithjavaapp.example.com - this is a big java app, with spring security and jsp's.




2. We are in the process of creating a new site based on reactjs that we want to embed as a page in the java JSP app. The reactjs site will be hosted at say - reactjs.example.com.

We need the reactjs.example.com to be able to access the bigmonolithjavaapp.example.com/api endpoint to share the same backend APIs. These endpoints are protected by spring security and because of that when I try to call the bigmonolithjavaapp.example.com/api endpoint from the reactjs.example.com pages, I am being redirected to the login page as there is no session sharing between these 2 domains.

Is there a way to extend the spring security session between both the domains?

To add to the mix, I have another restriction that I cannot change the document.domain on the pages for the bigmonolithjavaapp.example.com as there is a lot of business logic that happens on the page depending on the subdomain.

I see that there is CSRF Tokens, JSESSIONID (HttpOnly) and a bunch of other cookies in use today for the bigmonolithjavaapp.example.com

Is there a pattern or example on how to achieve this integration?

Update:
As I am reading more through the internet, I am now starting to think if JWT is a good fit for this or not?

1. User comes into bigmonolithjavaapp.example.com and authenticates himself.


2. User navigates to bigmonolithjavaapp.example.com/coolpage.html where I can embed the reactjs.example.com?token=<jwt_token> in an iframe.


3. 
   reactjs.example.com can use the jwt token to access the secured api resources from bigmonolithjavaapp.example.com.

Does this approach sound valid?

java spring reactjs spring-security jwt

share|improve this question

edited Mar 22 at 0:03

Satya

asked Mar 21 at 22:24

SatyaSatya

4731021

add a comment | 

I am a novice in Spring Security, but trying to figure how to handle the situation I have -

1. I have a site hosted at bigmonolithjavaapp.example.com - this is a big java app, with spring security and jsp's.




2. We are in the process of creating a new site based on reactjs that we want to embed as a page in the java JSP app. The reactjs site will be hosted at say - reactjs.example.com.

We need the reactjs.example.com to be able to access the bigmonolithjavaapp.example.com/api endpoint to share the same backend APIs. These endpoints are protected by spring security and because of that when I try to call the bigmonolithjavaapp.example.com/api endpoint from the reactjs.example.com pages, I am being redirected to the login page as there is no session sharing between these 2 domains.

Is there a way to extend the spring security session between both the domains?

To add to the mix, I have another restriction that I cannot change the document.domain on the pages for the bigmonolithjavaapp.example.com as there is a lot of business logic that happens on the page depending on the subdomain.

I see that there is CSRF Tokens, JSESSIONID (HttpOnly) and a bunch of other cookies in use today for the bigmonolithjavaapp.example.com

Is there a pattern or example on how to achieve this integration?

Update:
As I am reading more through the internet, I am now starting to think if JWT is a good fit for this or not?

1. User comes into bigmonolithjavaapp.example.com and authenticates himself.


2. User navigates to bigmonolithjavaapp.example.com/coolpage.html where I can embed the reactjs.example.com?token=<jwt_token> in an iframe.


3. 
   reactjs.example.com can use the jwt token to access the secured api resources from bigmonolithjavaapp.example.com.

Does this approach sound valid?

java spring reactjs spring-security jwt

share|improve this question

edited Mar 22 at 0:03

Satya

asked Mar 21 at 22:24

SatyaSatya

4731021

share|improve this question

edited Mar 22 at 0:03

Satya

asked Mar 21 at 22:24

SatyaSatya

4731021

share|improve this question

edited Mar 22 at 0:03

Satya

asked Mar 21 at 22:24

SatyaSatya

4731021

asked Mar 21 at 22:24

SatyaSatya

4731021

asked Mar 21 at 22:24

SatyaSatya

4731021