fix security configuration
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful

This commit is contained in:
dmitriy.churmeev
2026-03-29 15:20:51 +03:00
parent 85b33f9cb9
commit 6c52ec56cc

View File

@@ -16,8 +16,8 @@ import org.springframework.security.web.SecurityFilterChain
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableMethodSecurity( @EnableMethodSecurity(
prePostEnabled = true, // ← явно включаем prePostEnabled = true,
securedEnabled = true // ← опционально securedEnabled = true
) )
class WebSecurityConfig () { class WebSecurityConfig () {
@@ -26,24 +26,24 @@ class WebSecurityConfig () {
@Bean @Bean
@Throws(Exception::class) @Throws(Exception::class)
fun filterChain(http: HttpSecurity): SecurityFilterChain? { fun filterChain(http: HttpSecurity): SecurityFilterChain? {
http.authorizeHttpRequests(Customizer { auth -> http.authorizeHttpRequests { auth ->
auth.requestMatchers("/public/**", "/health", "/info").permitAll() auth.requestMatchers("/public/**", "/health", "/info").permitAll()
//auth.anyRequest().permitAll() //auth.anyRequest().permitAll()
auth.anyRequest().authenticated() auth.anyRequest().authenticated()
}) }
.oauth2ResourceServer(Customizer { oauth2 -> .oauth2ResourceServer { oauth2 ->
// oauth2!!.jwt(Customizer.withDefaults()) // oauth2!!.jwt(Customizer.withDefaults())
// добавляем конвертер для извлечения ролей // добавляем конвертер для извлечения ролей
oauth2.jwt { jwt -> oauth2.jwt { jwt ->
jwt.jwtAuthenticationConverter(jwtAuthenticationConverter()) jwt.jwtAuthenticationConverter(jwtAuthenticationConverter())
} }
}) // проверка JWT токен } // проверка JWT токен
.sessionManagement(Customizer { session: SessionManagementConfigurer<HttpSecurity?>? -> .sessionManagement { session: SessionManagementConfigurer<HttpSecurity?>? ->
session!!.sessionCreationPolicy(SessionCreationPolicy.STATELESS) session!!.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
}) // без сессий } // без сессий
.csrf(Customizer { csrf: CsrfConfigurer<HttpSecurity?>? -> csrf!!.disable() }) // отключаем CSRF для API .csrf { csrf: CsrfConfigurer<HttpSecurity?>? -> csrf!!.disable() } // отключаем CSRF для API
return http.build() return http.build()
} }