package com.pollex.pam.config;
|
|
import com.pollex.pam.security.*;
|
import com.pollex.pam.security.jwt.*;
|
import org.springframework.context.annotation.Bean;
|
import org.springframework.context.annotation.Import;
|
import org.springframework.http.HttpMethod;
|
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
import org.springframework.security.config.annotation.web.builders.WebSecurity;
|
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
|
import org.springframework.security.config.http.SessionCreationPolicy;
|
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
|
import org.springframework.security.crypto.password.PasswordEncoder;
|
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
|
import org.springframework.security.web.header.writers.ReferrerPolicyHeaderWriter;
|
import org.springframework.web.filter.CorsFilter;
|
import org.zalando.problem.spring.web.advice.security.SecurityProblemSupport;
|
import tech.jhipster.config.JHipsterProperties;
|
|
@EnableWebSecurity
|
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true)
|
@Import(SecurityProblemSupport.class)
|
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
|
|
private final JHipsterProperties jHipsterProperties;
|
|
private final TokenProvider tokenProvider;
|
|
private final CorsFilter corsFilter;
|
private final SecurityProblemSupport problemSupport;
|
|
public SecurityConfiguration(
|
TokenProvider tokenProvider,
|
CorsFilter corsFilter,
|
JHipsterProperties jHipsterProperties,
|
SecurityProblemSupport problemSupport
|
) {
|
this.tokenProvider = tokenProvider;
|
this.corsFilter = corsFilter;
|
this.problemSupport = problemSupport;
|
this.jHipsterProperties = jHipsterProperties;
|
}
|
|
@Bean
|
public PasswordEncoder passwordEncoder() {
|
return new BCryptPasswordEncoder();
|
}
|
|
@Override
|
public void configure(WebSecurity web) {
|
web.ignoring().antMatchers(HttpMethod.OPTIONS, "/**").antMatchers("/swagger-ui/**").antMatchers("/test/**");
|
}
|
|
@Override
|
public void configure(HttpSecurity http) throws Exception {
|
// @formatter:off
|
http
|
.csrf()
|
.disable()
|
.addFilterBefore(corsFilter, UsernamePasswordAuthenticationFilter.class)
|
.exceptionHandling()
|
.authenticationEntryPoint(problemSupport)
|
.accessDeniedHandler(problemSupport)
|
.and()
|
.headers()
|
.contentSecurityPolicy(jHipsterProperties.getSecurity().getContentSecurityPolicy())
|
.and()
|
.referrerPolicy(ReferrerPolicyHeaderWriter.ReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN)
|
.and()
|
.featurePolicy("geolocation 'none'; midi 'none'; sync-xhr 'none'; microphone 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'; fullscreen 'self'; payment 'none'")
|
.and()
|
.frameOptions()
|
.deny()
|
.and()
|
.sessionManagement()
|
.sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
|
.and()
|
.authorizeRequests()
|
.antMatchers("/api/authenticate").permitAll()
|
.antMatchers("/api/register").permitAll()
|
.antMatchers("/api/activate").permitAll()
|
.antMatchers("/api/testLogin/**").permitAll()
|
.antMatchers("/api/test/sendMsg/**").permitAll()
|
.antMatchers("/api/otp/**").permitAll()
|
.antMatchers("/api/login/validate/**").permitAll()
|
.antMatchers("/api/eService/authenticate").permitAll()
|
.antMatchers("/api/account/reset-password/init").permitAll()
|
.antMatchers("/api/account/reset-password/finish").permitAll()
|
.antMatchers("/api/consultant/recommend").permitAll()
|
.antMatchers("/api/consultant/detail").permitAll()
|
.antMatchers("/api/consultant/fastQuery").permitAll()
|
.antMatchers("/api/consultant/strictQuery").permitAll()
|
.antMatchers("/api/consultant/avatar/**").permitAll()
|
.antMatchers("/api/admin/**").hasAuthority(AuthoritiesConstants.ADMIN)
|
.antMatchers("/api/**").authenticated()
|
.antMatchers("/websocket/**").authenticated()
|
.antMatchers("/management/health").permitAll()
|
.antMatchers("/management/health/**").permitAll()
|
.antMatchers("/management/info").permitAll()
|
.antMatchers("/management/prometheus").permitAll()
|
.antMatchers("/management/**").hasAuthority(AuthoritiesConstants.ADMIN)
|
.and()
|
.httpBasic()
|
.and()
|
.apply(securityConfigurerAdapter());
|
// @formatter:on
|
}
|
|
private JWTConfigurer securityConfigurerAdapter() {
|
return new JWTConfigurer(tokenProvider);
|
}
|
}
|
