1 package org.imageconverter.config.security;
2
3 import static org.springframework.http.HttpMethod.DELETE;
4 import static org.springframework.http.HttpMethod.GET;
5 import static org.springframework.http.HttpMethod.POST;
6
7 import org.imageconverter.config.filter.CsrfLoggerFilter;
8 import org.springframework.context.annotation.Bean;
9 import org.springframework.context.annotation.Configuration;
10 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
11 import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
12 import org.springframework.security.web.SecurityFilterChain;
13 import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
14 import org.springframework.security.web.csrf.CsrfFilter;
15 import org.springframework.security.web.csrf.CsrfTokenRepository;
16 import org.springframework.security.web.firewall.HttpFirewall;
17
18
19
20
21
22
23
24
25 @Configuration
26 public class RestSecurityConfig {
27
28 private final String[] swaggerUiURL = {
29 "/v3/api-docs/**",
30 "/swagger-ui/**",
31 "/swagger-ui.html",
32 "/webjars/**"
33 };
34
35 private final RestAuthenticationSuccessHandler authenticationSuccessHandler;
36
37 private final HttpFirewall allowUrlEncodedSlashHttpFirewall;
38
39 private final CsrfTokenRepository csrfTokenRepository;
40
41 RestSecurityConfig(
42 final RestAuthenticationSuccessHandler authenticationSuccessHandler,
43 final HttpFirewall allowUrlEncodedSlashHttpFirewall,
44
45 final CsrfTokenRepository cookieCsrfTokenRepository
46 ) {
47
48 this.authenticationSuccessHandler = authenticationSuccessHandler;
49 this.allowUrlEncodedSlashHttpFirewall = allowUrlEncodedSlashHttpFirewall;
50 this.csrfTokenRepository = cookieCsrfTokenRepository;
51
52 }
53
54 @Bean
55 SecurityFilterChain filterChain(final HttpSecurity http) throws Exception {
56
57 final var restUrl = "/rest/**";
58
59 http.addFilterAfter(new CsrfLoggerFilter(), CsrfFilter.class)
60 .securityContext()
61 .and().exceptionHandling()
62 .and().servletApi()
63 .and().httpBasic()
64
65 .and().authorizeRequests()
66
67 .antMatchers(swaggerUiURL)
68 .permitAll()
69
70 .antMatchers(GET, restUrl)
71 .hasAnyRole("USER")
72
73 .antMatchers(POST, restUrl)
74 .hasRole("USER")
75
76
77
78
79 .antMatchers(DELETE, restUrl)
80 .access("hasRole('ROLE_ADMIN') or hasIpAddress('127.0.0.1') or hasIpAddress('0:0:0:0:0:0:0:1')")
81
82 .antMatchers(restUrl)
83 .hasAnyRole("ADMIN", "USER")
84
85 .and().formLogin()
86 .successHandler(authenticationSuccessHandler)
87 .failureHandler(new SimpleUrlAuthenticationFailureHandler())
88
89 .and().logout()
90 .logoutSuccessUrl("/")
91 .invalidateHttpSession(true)
92 .clearAuthentication(true)
93
94 .and().csrf()
95
96 .csrfTokenRepository(csrfTokenRepository)
97 .ignoringAntMatchers("/actuator/**")
98 ;
99
100 http.headers().frameOptions().sameOrigin();
101
102 return http.build();
103 }
104
105 @Bean
106 WebSecurityCustomizer webSecurityCustomizer() {
107 return (web) -> {
108 web.httpFirewall(allowUrlEncodedSlashHttpFirewall);
109 };
110 }
111 }