61 lines
2.4 KiB
Kotlin
61 lines
2.4 KiB
Kotlin
package net.xintanalabs.rssotto.config
|
|
|
|
import org.springframework.context.annotation.Bean
|
|
import org.springframework.context.annotation.Configuration
|
|
import org.springframework.http.HttpMethod
|
|
import org.springframework.security.authentication.AuthenticationProvider
|
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity
|
|
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
|
|
import org.springframework.security.config.http.SessionCreationPolicy
|
|
import org.springframework.security.web.DefaultSecurityFilterChain
|
|
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter
|
|
import org.springframework.web.cors.CorsConfiguration
|
|
import org.springframework.web.cors.UrlBasedCorsConfigurationSource
|
|
import org.springframework.web.filter.CorsFilter
|
|
|
|
@Configuration
|
|
@EnableWebSecurity
|
|
class SecurityConfiguration(
|
|
private val authenticationProvider: AuthenticationProvider
|
|
) {
|
|
@Bean
|
|
fun corsConfigurationSource(): UrlBasedCorsConfigurationSource {
|
|
val config = CorsConfiguration()
|
|
config.allowedOrigins = listOf("http://localhost:4200")
|
|
config.allowedMethods = listOf("GET", "POST", "PUT", "DELETE", "OPTIONS")
|
|
config.allowedHeaders = listOf("*")
|
|
config.allowCredentials = true
|
|
|
|
val source = UrlBasedCorsConfigurationSource()
|
|
source.registerCorsConfiguration("/**", config)
|
|
return source
|
|
}
|
|
|
|
@Bean
|
|
fun securityFilterChain(
|
|
http: HttpSecurity,
|
|
jwtAuthenticationFilter: JwtAuthenticationFilter
|
|
): DefaultSecurityFilterChain =
|
|
http
|
|
.cors { }
|
|
.csrf { it.disable() }
|
|
.authorizeHttpRequests {
|
|
it
|
|
.requestMatchers("/api/auth/**", "/error")
|
|
.permitAll()
|
|
.requestMatchers(HttpMethod.POST, "/api/user")
|
|
.permitAll()
|
|
.requestMatchers( "/api/user**")
|
|
.hasRole("ADMIN")
|
|
.anyRequest()
|
|
.fullyAuthenticated()
|
|
}
|
|
.sessionManagement {
|
|
it.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
|
|
}
|
|
.authenticationProvider(authenticationProvider)
|
|
.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter::class.java)
|
|
.build()
|
|
}
|
|
|