diff --git a/src/main/kotlin/com/auth/config/WebSecurityConfig.kt b/src/main/kotlin/com/auth/config/WebSecurityConfig.kt
index 6fff8e7..c27a672 100644
--- a/src/main/kotlin/com/auth/config/WebSecurityConfig.kt
+++ b/src/main/kotlin/com/auth/config/WebSecurityConfig.kt
@@ -5,8 +5,12 @@ import org.springframework.context.annotation.Configuration
 import org.springframework.security.config.Customizer
 import org.springframework.security.config.annotation.web.builders.HttpSecurity
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.configurers.LogoutConfigurer
-import org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer
+import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequestMatcherRegistry
+import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer
+import org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer
+import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer
+import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer.JwtConfigurer
+import org.springframework.security.config.http.SessionCreationPolicy
 import org.springframework.security.web.SecurityFilterChain
 
 
@@ -18,18 +22,43 @@ class WebSecurityConfig () {
     @Throws(Exception::class)
     fun filterChain(http: HttpSecurity): SecurityFilterChain? {
         http
-            .authorizeHttpRequests(Customizer { auth -> auth
-                .requestMatchers("/", "/home").permitAll()
-                .anyRequest().authenticated()
-            })
-            .oauth2Login(Customizer { oauth2: OAuth2LoginConfigurer<HttpSecurity?>? ->
+            .authorizeHttpRequests(Customizer { auth ->
+                auth
+                    .requestMatchers("/public/**").permitAll()
+                    .anyRequest().authenticated()
+            }
+            )
+            .oauth2ResourceServer(Customizer { oauth2 ->
                 oauth2!!
-                    .defaultSuccessUrl("/dashboard", true)
-                    .loginPage("/oauth2/authorization/keycloak") } // Spring сам редиректит
-            ).logout(Customizer { logout: LogoutConfigurer<HttpSecurity?>? ->
-                logout!!
-                    .logoutSuccessUrl("/") })
+                    .jwt(Customizer.withDefaults())
+            } // ← проверяем JWT токены
+            )
+            .sessionManagement(Customizer { session: SessionManagementConfigurer<HttpSecurity?>? ->
+                session!!
+                    .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
+            } // REST API без сессий
+            )
+            .csrf(Customizer { csrf: CsrfConfigurer<HttpSecurity?>? -> csrf!!.disable() }) // для API отключаем CSRF
 
         return http.build()
     }
+
+//    @Bean
+//    @Throws(Exception::class)
+//    fun filterChain(http: HttpSecurity): SecurityFilterChain? {
+//        http
+//            .authorizeHttpRequests(Customizer { auth -> auth
+//                .requestMatchers("/", "/home").permitAll()
+//                .anyRequest().authenticated()
+//            })
+//            .oauth2Login(Customizer { oauth2: OAuth2LoginConfigurer<HttpSecurity?>? ->
+//                oauth2!!
+//                    .defaultSuccessUrl("/dashboard", true)
+//                    .loginPage("/oauth2/authorization/keycloak") } // Spring сам редиректит
+//            ).logout(Customizer { logout: LogoutConfigurer<HttpSecurity?>? ->
+//                logout!!
+//                    .logoutSuccessUrl("/") })
+//
+//        return http.build()
+//    }
 }
\ No newline at end of file