|
7 | 7 | import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
|
8 | 8 | //import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
|
9 | 9 | import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
|
10 | | -import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; |
| 10 | +import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; |
11 | 11 | import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
12 | 12 | //import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
13 | 13 | //import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
|
|
23 | 23 |
|
24 | 24 | @Configuration
|
25 | 25 | //@EnableWebSecurity
|
26 | | -@EnableGlobalMethodSecurity( |
27 | | -// securedEnabled = true, |
28 | | -// jsr250Enabled = true, |
29 | | -prePostEnabled = true) |
| 26 | +@EnableMethodSecurity |
| 27 | +//(securedEnabled = true, |
| 28 | +//jsr250Enabled = true, |
| 29 | +//prePostEnabled = true) // by default |
30 | 30 | public class WebSecurityConfig { // extends WebSecurityConfigurerAdapter {
|
31 | | -@Autowired |
32 | | -UserDetailsServiceImpl userDetailsService; |
33 | | - |
34 | | -@Autowired |
35 | | -private AuthEntryPointJwt unauthorizedHandler; |
36 | | - |
37 | | -@Bean |
38 | | -public AuthTokenFilter authenticationJwtTokenFilter() { |
39 | | -return new AuthTokenFilter(); |
40 | | -} |
41 | | - |
42 | | -//@Override |
43 | | -//public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception { |
44 | | -//authenticationManagerBuilder.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder()); |
45 | | -//} |
46 | | - |
47 | | -@Bean |
| 31 | +@Autowired |
| 32 | +UserDetailsServiceImpl userDetailsService; |
| 33 | + |
| 34 | +@Autowired |
| 35 | +private AuthEntryPointJwt unauthorizedHandler; |
| 36 | + |
| 37 | +@Bean |
| 38 | +public AuthTokenFilter authenticationJwtTokenFilter() { |
| 39 | +return new AuthTokenFilter(); |
| 40 | +} |
| 41 | + |
| 42 | +//@Override |
| 43 | +//public void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception { |
| 44 | +//authenticationManagerBuilder.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder()); |
| 45 | +//} |
| 46 | + |
| 47 | +@Bean |
48 | 48 | public DaoAuthenticationProvider authenticationProvider() {
|
49 | | - DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider(); |
50 | | - |
51 | | - authProvider.setUserDetailsService(userDetailsService); |
52 | | - authProvider.setPasswordEncoder(passwordEncoder()); |
53 | | - |
54 | | - return authProvider; |
| 49 | + DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider(); |
| 50 | + |
| 51 | + authProvider.setUserDetailsService(userDetailsService); |
| 52 | + authProvider.setPasswordEncoder(passwordEncoder()); |
| 53 | + |
| 54 | + return authProvider; |
55 | 55 | }
|
56 | 56 |
|
57 | | -//@Bean |
58 | | -//@Override |
59 | | -//public AuthenticationManager authenticationManagerBean() throws Exception { |
60 | | -//return super.authenticationManagerBean(); |
61 | | -//} |
62 | | - |
63 | | -@Bean |
| 57 | +//@Bean |
| 58 | +//@Override |
| 59 | +//public AuthenticationManager authenticationManagerBean() throws Exception { |
| 60 | +//return super.authenticationManagerBean(); |
| 61 | +//} |
| 62 | + |
| 63 | +@Bean |
64 | 64 | public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
|
65 | 65 | return authConfig.getAuthenticationManager();
|
66 | 66 | }
|
67 | 67 |
|
68 | | -@Bean |
69 | | -public PasswordEncoder passwordEncoder() { |
70 | | -return new BCryptPasswordEncoder(); |
71 | | -} |
72 | | - |
73 | | -//@Override |
74 | | -//protected void configure(HttpSecurity http) throws Exception { |
75 | | -//http.cors().and().csrf().disable() |
76 | | -//.exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and() |
77 | | -//.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and() |
78 | | -//.authorizeRequests().antMatchers("/api/auth/**").permitAll() |
79 | | -//.antMatchers("/api/test/**").permitAll() |
80 | | -//.anyRequest().authenticated(); |
| 68 | +@Bean |
| 69 | +public PasswordEncoder passwordEncoder() { |
| 70 | +return new BCryptPasswordEncoder(); |
| 71 | +} |
| 72 | + |
| 73 | +//@Override |
| 74 | +//protected void configure(HttpSecurity http) throws Exception { |
| 75 | +//http.cors().and().csrf().disable() |
| 76 | +//.exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and() |
| 77 | +//.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and() |
| 78 | +//.authorizeRequests().antMatchers("/api/auth/**").permitAll() |
| 79 | +//.antMatchers("/api/test/**").permitAll() |
| 80 | +//.anyRequest().authenticated(); |
81 | 81 | //
|
82 | | -//http.addFilterBefore(authenticationJwtTokenFilter(), UsernamePasswordAuthenticationFilter.class); |
83 | | -//} |
84 | | - |
85 | | -@Bean |
| 82 | +//http.addFilterBefore(authenticationJwtTokenFilter(), UsernamePasswordAuthenticationFilter.class); |
| 83 | +//} |
| 84 | + |
| 85 | +@Bean |
86 | 86 | public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
|
87 | | - http.cors().and().csrf().disable() |
88 | | - .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and() |
89 | | - .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and() |
90 | | - .authorizeRequests().antMatchers("/api/auth/**").permitAll() |
91 | | - .antMatchers("/api/test/**").permitAll() |
92 | | - .anyRequest().authenticated(); |
93 | | - |
| 87 | + http.csrf(csrf -> csrf.disable()) |
| 88 | + .exceptionHandling(exception -> exception.authenticationEntryPoint(unauthorizedHandler)) |
| 89 | + .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) |
| 90 | + .authorizeHttpRequests(auth -> auth.requestMatchers("/api/auth/**").permitAll().requestMatchers("/api/test/**") |
| 91 | + .permitAll().anyRequest().authenticated()); |
| 92 | + |
94 | 93 | http.authenticationProvider(authenticationProvider());
|
95 | 94 |
|
96 | 95 | http.addFilterBefore(authenticationJwtTokenFilter(), UsernamePasswordAuthenticationFilter.class);
|
97 | | - |
| 96 | + |
98 | 97 | return http.build();
|
99 | 98 | }
|
100 | 99 | }
|
0 commit comments