fix security configuration
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful

This commit is contained in:
dmitriy.churmeev
2026-03-29 15:20:51 +03:00
parent 85b33f9cb9
commit 6c52ec56cc

View File

@@ -16,8 +16,8 @@ import org.springframework.security.web.SecurityFilterChain
@Configuration
@EnableWebSecurity
@EnableMethodSecurity(
prePostEnabled = true, // ← явно включаем
securedEnabled = true // ← опционально
prePostEnabled = true,
securedEnabled = true
)
class WebSecurityConfig () {
@@ -26,24 +26,24 @@ class WebSecurityConfig () {
@Bean
@Throws(Exception::class)
fun filterChain(http: HttpSecurity): SecurityFilterChain? {
http.authorizeHttpRequests(Customizer { auth ->
http.authorizeHttpRequests { auth ->
auth.requestMatchers("/public/**", "/health", "/info").permitAll()
//auth.anyRequest().permitAll()
auth.anyRequest().authenticated()
})
.oauth2ResourceServer(Customizer { oauth2 ->
}
.oauth2ResourceServer { oauth2 ->
// oauth2!!.jwt(Customizer.withDefaults())
// добавляем конвертер для извлечения ролей
oauth2.jwt { jwt ->
jwt.jwtAuthenticationConverter(jwtAuthenticationConverter())
}
}) // проверка JWT токен
.sessionManagement(Customizer { session: SessionManagementConfigurer<HttpSecurity?>? ->
} // проверка JWT токен
.sessionManagement { session: SessionManagementConfigurer<HttpSecurity?>? ->
session!!.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
}) // без сессий
.csrf(Customizer { csrf: CsrfConfigurer<HttpSecurity?>? -> csrf!!.disable() }) // отключаем CSRF для API
} // без сессий
.csrf { csrf: CsrfConfigurer<HttpSecurity?>? -> csrf!!.disable() } // отключаем CSRF для API
return http.build()
}