3
3
import com .github .throyer .common .springboot .domain .session .service .SessionService ;
4
4
import com .github .throyer .common .springboot .middlewares .AuthorizationMiddleware ;
5
5
import org .springframework .beans .factory .annotation .Autowired ;
6
- import org .springframework .beans .factory .annotation .Value ;
7
6
import org .springframework .context .annotation .Bean ;
8
7
import org .springframework .context .annotation .Configuration ;
9
8
import org .springframework .core .annotation .Order ;
14
13
import org .springframework .security .config .annotation .web .builders .WebSecurity ;
15
14
import org .springframework .security .config .annotation .web .configuration .EnableWebSecurity ;
16
15
import org .springframework .security .config .annotation .web .configuration .WebSecurityConfigurerAdapter ;
17
- import org .springframework .security .crypto .bcrypt .BCryptPasswordEncoder ;
18
16
import org .springframework .security .web .authentication .UsernamePasswordAuthenticationFilter ;
19
17
import org .springframework .security .web .util .matcher .AntPathRequestMatcher ;
20
18
import org .springframework .stereotype .Component ;
30
28
@ EnableWebSecurity
31
29
@ EnableGlobalMethodSecurity (prePostEnabled = true )
32
30
public class SpringSecurityConfiguration {
33
-
34
- @ Autowired
35
- private SessionService sessionService ;
36
31
37
- @ Autowired
38
- private BCryptPasswordEncoder encoder ;
32
+ private final SessionService sessionService ;
33
+ private final AuthorizationMiddleware filter ;
39
34
40
35
@ Autowired
41
- private AuthorizationMiddleware filter ;
42
-
43
- private static String SECRET ;
44
-
45
- public SpringSecurityConfiguration ( @ Value ( "${token.secret}" ) String secret ) {
46
- SpringSecurityConfiguration . SECRET = secret ;
36
+ public SpringSecurityConfiguration (
37
+ SessionService sessionService ,
38
+ AuthorizationMiddleware filter
39
+ ) {
40
+ this . sessionService = sessionService ;
41
+ this . filter = filter ;
47
42
}
48
43
49
44
@ Order (1 )
50
45
@ Configuration
51
46
public class Api extends WebSecurityConfigurerAdapter {
52
-
47
+
53
48
@ Override
54
49
protected void configure (AuthenticationManagerBuilder auth ) throws Exception {
55
50
auth .userDetailsService (sessionService )
56
- .passwordEncoder (encoder );
51
+ .passwordEncoder (PASSWORD_ENCODER );
57
52
}
58
-
53
+
59
54
@ Override
60
55
protected void configure (HttpSecurity http ) throws Exception {
61
56
http
62
57
.antMatcher ("/api/**" )
63
58
.authorizeRequests ()
64
- .antMatchers (
65
- GET ,
66
- "/api" ,
67
- "/api/documentation/**"
68
- )
59
+ .antMatchers (GET , "/api" , "/api/documentation/**" )
69
60
.permitAll ()
70
- .antMatchers (
71
- POST ,
72
- "/api/users" ,
73
- "/api/sessions/**" ,
74
- "/api/recoveries/**" ,
75
- "/api/documentation/**"
76
- )
61
+ .antMatchers (POST , "/api/users" , "/api/sessions/**" , "/api/recoveries/**" , "/api/documentation/**" )
77
62
.permitAll ()
78
63
.anyRequest ()
79
64
.authenticated ()
80
65
.and ()
81
66
.csrf ()
82
67
.disable ()
83
- .exceptionHandling ()
84
- .authenticationEntryPoint ((request , response , exception ) -> forbidden (response ))
68
+ .exceptionHandling ()
69
+ .authenticationEntryPoint ((request , response , exception ) -> forbidden (response ))
85
70
.and ()
86
71
.sessionManagement ()
87
72
.sessionCreationPolicy (STATELESS )
@@ -90,50 +75,40 @@ protected void configure(HttpSecurity http) throws Exception {
90
75
.cors ()
91
76
.configurationSource (request -> new CorsConfiguration ().applyPermitDefaultValues ());
92
77
}
93
-
78
+
94
79
@ Override
95
- public void configure (WebSecurity web ) throws Exception {
80
+ public void configure (WebSecurity web ) {
96
81
web
97
82
.ignoring ()
98
83
.antMatchers (STATIC_FILES );
99
84
}
100
-
85
+
101
86
@ Bean
102
87
@ Override
103
88
protected AuthenticationManager authenticationManager () throws Exception {
104
89
return super .authenticationManager ();
105
90
}
106
91
}
107
-
92
+
108
93
@ Order (2 )
109
94
@ Configuration
110
95
public class App extends WebSecurityConfigurerAdapter {
111
96
@ Override
112
97
protected void configure (AuthenticationManagerBuilder auth ) throws Exception {
113
98
auth .
114
99
userDetailsService (sessionService )
115
- .passwordEncoder (encoder );
100
+ .passwordEncoder (PASSWORD_ENCODER );
116
101
}
117
-
102
+
118
103
@ Override
119
104
protected void configure (HttpSecurity http ) throws Exception {
120
-
105
+
121
106
http
122
107
.antMatcher ("/app/**" )
123
108
.authorizeRequests ()
124
- .antMatchers (
125
- GET ,
126
- LOGIN_URL ,
127
- "/app" ,
128
- "/app/register" ,
129
- "/app/recovery/**"
130
- )
109
+ .antMatchers (GET , LOGIN_URL , "/app" , "/app/register" , "/app/recovery/**" )
131
110
.permitAll ()
132
- .antMatchers (
133
- POST ,
134
- "/app/register" ,
135
- "/app/recovery/**"
136
- )
111
+ .antMatchers (POST , "/app/register" , "/app/recovery/**" )
137
112
.permitAll ()
138
113
.anyRequest ()
139
114
.authenticated ()
@@ -146,11 +121,11 @@ protected void configure(HttpSecurity http) throws Exception {
146
121
.defaultSuccessUrl (HOME_URL )
147
122
.usernameParameter (USERNAME_PARAMETER )
148
123
.passwordParameter (PASSWORD_PARAMETER )
149
- .and ()
124
+ .and ()
150
125
.rememberMe ()
151
- .key (SECRET )
126
+ .key (TOKEN_SECRET )
152
127
.tokenValiditySeconds (DAY_MILLISECONDS )
153
- .and ()
128
+ .and ()
154
129
.logout ()
155
130
.deleteCookies (SESSION_COOKIE_NAME )
156
131
.logoutRequestMatcher (new AntPathRequestMatcher (LOGOUT_URL ))
0 commit comments