fix security configuration
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
This commit is contained in:
@@ -16,8 +16,8 @@ import org.springframework.security.web.SecurityFilterChain
|
|||||||
@Configuration
|
@Configuration
|
||||||
@EnableWebSecurity
|
@EnableWebSecurity
|
||||||
@EnableMethodSecurity(
|
@EnableMethodSecurity(
|
||||||
prePostEnabled = true, // ← явно включаем
|
prePostEnabled = true,
|
||||||
securedEnabled = true // ← опционально
|
securedEnabled = true
|
||||||
)
|
)
|
||||||
class WebSecurityConfig () {
|
class WebSecurityConfig () {
|
||||||
|
|
||||||
@@ -26,24 +26,24 @@ class WebSecurityConfig () {
|
|||||||
@Bean
|
@Bean
|
||||||
@Throws(Exception::class)
|
@Throws(Exception::class)
|
||||||
fun filterChain(http: HttpSecurity): SecurityFilterChain? {
|
fun filterChain(http: HttpSecurity): SecurityFilterChain? {
|
||||||
http.authorizeHttpRequests(Customizer { auth ->
|
http.authorizeHttpRequests { auth ->
|
||||||
|
|
||||||
auth.requestMatchers("/public/**", "/health", "/info").permitAll()
|
auth.requestMatchers("/public/**", "/health", "/info").permitAll()
|
||||||
//auth.anyRequest().permitAll()
|
//auth.anyRequest().permitAll()
|
||||||
auth.anyRequest().authenticated()
|
auth.anyRequest().authenticated()
|
||||||
|
|
||||||
})
|
}
|
||||||
.oauth2ResourceServer(Customizer { oauth2 ->
|
.oauth2ResourceServer { oauth2 ->
|
||||||
// oauth2!!.jwt(Customizer.withDefaults())
|
// oauth2!!.jwt(Customizer.withDefaults())
|
||||||
// добавляем конвертер для извлечения ролей
|
// добавляем конвертер для извлечения ролей
|
||||||
oauth2.jwt { jwt ->
|
oauth2.jwt { jwt ->
|
||||||
jwt.jwtAuthenticationConverter(jwtAuthenticationConverter())
|
jwt.jwtAuthenticationConverter(jwtAuthenticationConverter())
|
||||||
}
|
}
|
||||||
}) // проверка JWT токен
|
} // проверка JWT токен
|
||||||
.sessionManagement(Customizer { session: SessionManagementConfigurer<HttpSecurity?>? ->
|
.sessionManagement { session: SessionManagementConfigurer<HttpSecurity?>? ->
|
||||||
session!!.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
|
session!!.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
|
||||||
}) // без сессий
|
} // без сессий
|
||||||
.csrf(Customizer { csrf: CsrfConfigurer<HttpSecurity?>? -> csrf!!.disable() }) // отключаем CSRF для API
|
.csrf { csrf: CsrfConfigurer<HttpSecurity?>? -> csrf!!.disable() } // отключаем CSRF для API
|
||||||
|
|
||||||
return http.build()
|
return http.build()
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user