DmitriyChurmeev/test
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix security configuration
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
Details

Browse Source
This commit is contained in:
dmitriy.churmeev
2026-03-29 01:53:34 +03:00
parent 91da1910f8
commit 57fffb3a5a
1 changed files with 28 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

32
src/main/kotlin/com/auth/config/WebSecurityConfig.kt
View File

@@ -24,25 +24,49 @@ class WebSecurityConfig () {
http http
.authorizeHttpRequests(Customizer { auth -> .authorizeHttpRequests(Customizer { auth ->
auth auth
.requestMatchers("/public/**").permitAll()
.anyRequest().authenticated() .anyRequest().authenticated()
} }
) )
.oauth2ResourceServer(Customizer { oauth2 -> .oauth2ResourceServer(Customizer { oauth2 ->
oauth2!! oauth2!!
.jwt(Customizer.withDefaults()) .jwt(Customizer.withDefaults())
} // ← проверяем JWT токены } // ← проверяем JWT токен
) )
.sessionManagement(Customizer { session: SessionManagementConfigurer<HttpSecurity?>? -> .sessionManagement(Customizer { session: SessionManagementConfigurer<HttpSecurity?>? ->
session!! session!!
.sessionCreationPolicy(SessionCreationPolicy.STATELESS) .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
} // REST API без сессий } // без сессий
) )
.csrf(Customizer { csrf: CsrfConfigurer<HttpSecurity?>? -> csrf!!.disable() }) // для API отключаем CSRF .csrf(Customizer { csrf: CsrfConfigurer<HttpSecurity?>? -> csrf!!.disable() }) // отключаем CSRF для API
return http.build() return http.build()
} }
// @Bean
// @Throws(Exception::class)
// fun filterChain(http: HttpSecurity): SecurityFilterChain? {
// http
// .authorizeHttpRequests(Customizer { auth ->
// auth
// .requestMatchers("/public/**").permitAll()
// .anyRequest().authenticated()
// }
// )
// .oauth2ResourceServer(Customizer { oauth2 ->
// oauth2!!
// .jwt(Customizer.withDefaults())
// } // ← проверяем JWT токены
// )
// .sessionManagement(Customizer { session: SessionManagementConfigurer<HttpSecurity?>? ->
// session!!
// .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
// } // REST API без сессий
// )
// .csrf(Customizer { csrf: CsrfConfigurer<HttpSecurity?>? -> csrf!!.disable() }) // для API отключаем CSRF
//
// return http.build()
// }
// @Bean // @Bean
// @Throws(Exception::class) // @Throws(Exception::class)
// fun filterChain(http: HttpSecurity): SecurityFilterChain? { // fun filterChain(http: HttpSecurity): SecurityFilterChain? {