DmitriyChurmeev/test
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix security configuration
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
Details

Browse Source
This commit is contained in:
dmitriy.churmeev
2026-03-29 01:12:55 +03:00
parent 1ca3339bb3
commit 91da1910f8
1 changed files with 41 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
src/main/kotlin/com/auth/config/WebSecurityConfig.kt
View File

@@ -5,8 +5,12 @@ import org.springframework.context.annotation.Configuration
import org.springframework.security.config.Customizer import org.springframework.security.config.Customizer
import org.springframework.security.config.annotation.web.builders.HttpSecurity import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
import org.springframework.security.config.annotation.web.configurers.LogoutConfigurer import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequestMatcherRegistry
import org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer
import org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer
import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer
import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer.JwtConfigurer
import org.springframework.security.config.http.SessionCreationPolicy
import org.springframework.security.web.SecurityFilterChain import org.springframework.security.web.SecurityFilterChain
@@ -18,18 +22,43 @@ class WebSecurityConfig () {
@Throws(Exception::class) @Throws(Exception::class)
fun filterChain(http: HttpSecurity): SecurityFilterChain? { fun filterChain(http: HttpSecurity): SecurityFilterChain? {
http http
.authorizeHttpRequests(Customizer { auth -> auth .authorizeHttpRequests(Customizer { auth ->
.requestMatchers("/", "/home").permitAll() auth
.anyRequest().authenticated() .requestMatchers("/public/**").permitAll()
}) .anyRequest().authenticated()
.oauth2Login(Customizer { oauth2: OAuth2LoginConfigurer<HttpSecurity?>? -> }
)
.oauth2ResourceServer(Customizer { oauth2 ->
oauth2!! oauth2!!
.defaultSuccessUrl("/dashboard", true) .jwt(Customizer.withDefaults())
.loginPage("/oauth2/authorization/keycloak") } // Spring сам редиректит } // ← проверяем JWT токены
).logout(Customizer { logout: LogoutConfigurer<HttpSecurity?>? -> )
logout!! .sessionManagement(Customizer { session: SessionManagementConfigurer<HttpSecurity?>? ->
.logoutSuccessUrl("/") }) session!!
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
} // REST API без сессий
)
.csrf(Customizer { csrf: CsrfConfigurer<HttpSecurity?>? -> csrf!!.disable() }) // для API отключаем CSRF
return http.build() return http.build()
} }
// @Bean
// @Throws(Exception::class)
// fun filterChain(http: HttpSecurity): SecurityFilterChain? {
// http
// .authorizeHttpRequests(Customizer { auth -> auth
// .requestMatchers("/", "/home").permitAll()
// .anyRequest().authenticated()
// })
// .oauth2Login(Customizer { oauth2: OAuth2LoginConfigurer<HttpSecurity?>? ->
// oauth2!!
// .defaultSuccessUrl("/dashboard", true)
// .loginPage("/oauth2/authorization/keycloak") } // Spring сам редиректит
// ).logout(Customizer { logout: LogoutConfigurer<HttpSecurity?>? ->
// logout!!
// .logoutSuccessUrl("/") })
//
// return http.build()
// }
} }