80 lines
3.6 KiB
Kotlin
80 lines
3.6 KiB
Kotlin
package com.auth.config
|
|
|
|
import org.springframework.context.annotation.Bean
|
|
import org.springframework.context.annotation.Configuration
|
|
import org.springframework.security.config.Customizer
|
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity
|
|
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
|
|
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequestMatcherRegistry
|
|
import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer
|
|
import org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer
|
|
import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer
|
|
import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer.JwtConfigurer
|
|
import org.springframework.security.config.http.SessionCreationPolicy
|
|
import org.springframework.security.web.SecurityFilterChain
|
|
|
|
|
|
@Configuration
|
|
@EnableWebSecurity
|
|
class WebSecurityConfig () {
|
|
|
|
@Bean
|
|
@Throws(Exception::class)
|
|
fun filterChain(http: HttpSecurity): SecurityFilterChain? {
|
|
http.authorizeHttpRequests(Customizer { auth ->
|
|
auth.anyRequest().authenticated() })
|
|
.oauth2ResourceServer(Customizer { oauth2 ->
|
|
oauth2!!.jwt(Customizer.withDefaults())
|
|
}) // ← проверяем JWT токен
|
|
.sessionManagement(Customizer { session: SessionManagementConfigurer<HttpSecurity?>? ->
|
|
session!!.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
|
|
}) // без сессий
|
|
.csrf(Customizer { csrf: CsrfConfigurer<HttpSecurity?>? -> csrf!!.disable() }) // отключаем CSRF для API
|
|
|
|
return http.build()
|
|
}
|
|
|
|
// @Bean
|
|
// @Throws(Exception::class)
|
|
// fun filterChain(http: HttpSecurity): SecurityFilterChain? {
|
|
// http
|
|
// .authorizeHttpRequests(Customizer { auth ->
|
|
// auth
|
|
// .requestMatchers("/public/**").permitAll()
|
|
// .anyRequest().authenticated()
|
|
// }
|
|
// )
|
|
// .oauth2ResourceServer(Customizer { oauth2 ->
|
|
// oauth2!!
|
|
// .jwt(Customizer.withDefaults())
|
|
// } // ← проверяем JWT токены
|
|
// )
|
|
// .sessionManagement(Customizer { session: SessionManagementConfigurer<HttpSecurity?>? ->
|
|
// session!!
|
|
// .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
|
|
// } // REST API без сессий
|
|
// )
|
|
// .csrf(Customizer { csrf: CsrfConfigurer<HttpSecurity?>? -> csrf!!.disable() }) // для API отключаем CSRF
|
|
//
|
|
// return http.build()
|
|
// }
|
|
|
|
// @Bean
|
|
// @Throws(Exception::class)
|
|
// fun filterChain(http: HttpSecurity): SecurityFilterChain? {
|
|
// http
|
|
// .authorizeHttpRequests(Customizer { auth -> auth
|
|
// .requestMatchers("/", "/home").permitAll()
|
|
// .anyRequest().authenticated()
|
|
// })
|
|
// .oauth2Login(Customizer { oauth2: OAuth2LoginConfigurer<HttpSecurity?>? ->
|
|
// oauth2!!
|
|
// .defaultSuccessUrl("/dashboard", true)
|
|
// .loginPage("/oauth2/authorization/keycloak") } // Spring сам редиректит
|
|
// ).logout(Customizer { logout: LogoutConfigurer<HttpSecurity?>? ->
|
|
// logout!!
|
|
// .logoutSuccessUrl("/") })
|
|
//
|
|
// return http.build()
|
|
// }
|
|
} |