# How to bypass flowable-admin login restrictions **URL:** \ **Category:** Flowable Engine\ **Created:** [July 15, 2019, 12:53pm UTC](https://forum.flowable.org/t/how-to-bypass-flowable-admin-login-restrictions/4185 "2019-07-15T12:53:09Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![yepengchen](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/yepengchen/32/1307_2.png) [@yepengchen](https://forum.flowable.org/u/yepengchen)\ **Post date:** [July 15, 2019, 12:53pm UTC](https://forum.flowable.org/t/how-to-bypass-flowable-admin-login-restrictions/4185/1 "2019-07-15T12:53:09Z")
hello,I want to customize flowable-admin,I need to bypass login restrictions ,what should I do？ ---
**Author:** ![yvo](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/yvo/32/2231_2.png) [@yvo](https://forum.flowable.org/u/yvo)\ **Post date:** [July 15, 2019, 2:47pm UTC](https://forum.flowable.org/t/how-to-bypass-flowable-admin-login-restrictions/4185/2 "2019-07-15T14:47:37Z")
Hi, you could create your own Spring Security configuration. F.e. something like this; ``` @Configuration public class SecurityConfiguration extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http.csrf().disable().authorizeRequests().anyRequest().permitAll(); } } ``` Regards, Yvo ---
**Author:** ![yepengchen](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/yepengchen/32/1307_2.png) [@yepengchen](https://forum.flowable.org/u/yepengchen)\ **Post date:** [July 16, 2019, 5:57am UTC](https://forum.flowable.org/t/how-to-bypass-flowable-admin-login-restrictions/4185/3 "2019-07-16T05:57:07Z")
Hello,thank you for your reply,but there still some problems.After I add this,it run normally,but I still can’t bypass. This is related log. 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.boot.web.servlet.filter.OrderedRequestContextFilter - Bound request context to thread: org.apache.catalina.connector.RequestFacade@f7ac61e 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.util.matcher.AntPathRequestMatcher - Checking match of request : ‘/’; against ‘/actuator/\*\*’ 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.FilterChainProxy - / at position 1 of 11 in additional filter chain; firing Filter: ‘WebAsyncManagerIntegrationFilter’ 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.FilterChainProxy - / at position 2 of 11 in additional filter chain; firing Filter: ‘SecurityContextPersistenceFilter’ 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.context.HttpSessionSecurityContextRepository - No HttpSession currently exists 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.context.HttpSessionSecurityContextRepository - No SecurityContext was available from the HttpSession: null. A new one will be created. 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.FilterChainProxy - / at position 3 of 11 in additional filter chain; firing Filter: ‘HeaderWriterFilter’ 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.FilterChainProxy - / at position 4 of 11 in additional filter chain; firing Filter: ‘LogoutFilter’ 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.util.matcher.OrRequestMatcher - Trying to match using Ant [pattern=’/app/logout’, GET] 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.util.matcher.AntPathRequestMatcher - Checking match of request : ‘/’; against ‘/app/logout’ 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.util.matcher.OrRequestMatcher - Trying to match using Ant [pattern=’/app/logout’, POST] 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.util.matcher.AntPathRequestMatcher - Request ‘GET /’ doesn’t match ‘POST /app/logout 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.util.matcher.OrRequestMatcher - Trying to match using Ant [pattern=’/app/logout’, PUT] 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.util.matcher.AntPathRequestMatcher - Request ‘GET /’ doesn’t match ‘PUT /app/logout 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.util.matcher.OrRequestMatcher - Trying to match using Ant [pattern=’/app/logout’, DELETE] 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.util.matcher.AntPathRequestMatcher - Request ‘GET /’ doesn’t match 'DELETE /app/logout 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.util.matcher.OrRequestMatcher - No matches found 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.FilterChainProxy - / at position 5 of 11 in additional filter chain; firing Filter: ‘FlowableCookieFilter’ 13:51:53.744 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.header.writers.HstsHeaderWriter - Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@5f0e9155 13:51:53.745 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.context.HttpSessionSecurityContextRepository - SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession. 13:51:53.745 [http-nio-9988-exec-3] DEBUG org.springframework.security.web.context.SecurityContextPersistenceFilter - SecurityContextHolder now cleared, as request processing completed 13:51:53.745 [http-nio-9988-exec-3] DEBUG org.springframework.boot.web.servlet.filter.OrderedRequestContextFilter - Cleared thread-bound request context: org.apache.catalina.connector.RequestFacade@f7ac61e ---
**Author:** ![yepengchen](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/yepengchen/32/1307_2.png) [@yepengchen](https://forum.flowable.org/u/yepengchen)\ **Post date:** [July 17, 2019, 1:42am UTC](https://forum.flowable.org/t/how-to-bypass-flowable-admin-login-restrictions/4185/4 "2019-07-17T01:42:39Z")
hello,can you help me analysis this? thank you so much. ---
**Author:** ![yvo](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/yvo/32/2231_2.png) [@yvo](https://forum.flowable.org/u/yvo)\ **Post date:** [July 17, 2019, 7:08am UTC](https://forum.flowable.org/t/how-to-bypass-flowable-admin-login-restrictions/4185/5 "2019-07-17T07:08:32Z")
Hi, It seems you still have the Flowable security configuration active. Did you replace or remove the current `SecurityConfiguration` ? In addition to that you need to edit the `app.js` because it will call a account REST service. You will need to replace ```auto $http.get('/app/rest/account') .success(function (data, status, headers, config) { $rootScope.account = data; $rootScope.authenticated = true; $rootScope.loadServerConfig(false); }); ``` with ```auto $rootScope.authenticated = true; $rootScope.loadServerConfig(false); ``` Hope this helps. Yvo ---
**Author:** ![yepengchen](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/yepengchen/32/1307_2.png) [@yepengchen](https://forum.flowable.org/u/yepengchen)\ **Post date:** [July 18, 2019, 2:06am UTC](https://forum.flowable.org/t/how-to-bypass-flowable-admin-login-restrictions/4185/6 "2019-07-18T02:06:35Z")
thank you,after I change both of this ,and remove default security configuration.It works successfully ---
**Author:** ![vigneshra](https://avatars.discourse-cdn.com/v4/letter/v/13edae/32.png) [@vigneshra](https://forum.flowable.org/u/vigneshra)\ **Post date:** [November 15, 2019, 7:38am UTC](https://forum.flowable.org/t/how-to-bypass-flowable-admin-login-restrictions/4185/7 "2019-11-15T07:38:51Z")
Hi, 1.Where exactly does the SecurityConfiguration class needs to be deployed if I have the WAR files deployed in a local tomcat server to be overriden? 2.In similar terms what changes are required if I need to bypass the security / login page in flowable-modeler? Thanks in advance ---
**Author:** ![umutkazan](https://avatars.discourse-cdn.com/v4/letter/u/0ea827/32.png) [@umutkazan](https://forum.flowable.org/u/umutkazan)\ **Post date:** [March 21, 2022, 11:43pm UTC](https://forum.flowable.org/t/how-to-bypass-flowable-admin-login-restrictions/4185/8 "2022-03-21T23:43:01Z")
did you solve your issue? this is my security config ```auto http .authorizeRequests() .antMatchers("/actuator/**").permitAll().and() .csrf().ignoringAntMatchers("/app/**").and() .authorizeRequests( authorizeRequests -> authorizeRequests .antMatchers("/*-api/ **", , "/app/**").permitAll() // would get 401 on engines in admin panel without this???? .anyRequest() .authenticated() ) .oauth2Login(oauthLogin -> oauthLogin.permitAll()) //redirect to login if no token or session is provided .oauth2ResourceServer().jwt(); http.logout() .logoutRequestMatcher(new AntPathRequestMatcher("/app/logout")) .logoutSuccessHandler(keycloakLogoutHandler); ``` I know it doesn’t make much sense this config but at least I can see see and use all ui components with this on my local but on dev I get `angular.js:9827 GET /app/rest/account 500` anyone know how to solve this? ---
**Author:** ![yvo](https://yyz1.discourse-cdn.com/flex035/user_avatar/forum.flowable.org/yvo/32/2231_2.png) [@yvo](https://forum.flowable.org/u/yvo)\ **Post date:** [March 22, 2022, 9:38am UTC](https://forum.flowable.org/t/how-to-bypass-flowable-admin-login-restrictions/4185/9 "2022-03-22T09:38:05Z")
I’m not sure… but could it be that you’re removing the need for logging in; but the `/app/rest/account` (which will try to fetch the logged in user) endpoint is still invoked? When doing modifications like removing the need for logging in; perhaps some additional modifications are needed. Because the UI does not support this use case by default. Did you look at the previous replies in this topic? About replacing the js bit? Also; it helps providing more info. Especially in old topics. What version are you on? What does the stack trace contain. Etc. Yvo