Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 2de7c17

Browse files
feat: add possibility to disable specific endpoints
1 parent 03d7605 commit 2de7c17

File tree

2 files changed

+28
-2
lines changed

2 files changed

+28
-2
lines changed

‎server/api-service/lowcoder-sdk/src/main/java/org/lowcoder/sdk/config/CommonConfig.java‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,9 +8,11 @@
88
import java.util.Set;
99

1010
import org.apache.commons.collections4.CollectionUtils;
11+
import org.apache.commons.collections4.ListUtils;
1112
import org.apache.commons.lang3.StringUtils;
1213
import org.lowcoder.sdk.constants.WorkspaceMode;
1314
import org.springframework.boot.context.properties.ConfigurationProperties;
15+
import org.springframework.http.HttpMethod;
1416
import org.springframework.stereotype.Component;
1517

1618
import lombok.Data;
@@ -63,6 +65,8 @@ public static class Security {
6365
// support of docker env file.
6466
private String corsAllowedDomainString;
6567

68+
private List<ApiEndpoint> forbiddenEndpoints;
69+
6670
public List<String> getAllCorsAllowedDomains() {
6771
List<String> all = new ArrayList<>();
6872
if (CollectionUtils.isNotEmpty(corsAllowedDomains)) {
@@ -74,8 +78,19 @@ public List<String> getAllCorsAllowedDomains() {
7478
}
7579
return all;
7680
}
81+
82+
public List<ApiEndpoint> getForbiddenEndpoints()
83+
{
84+
return ListUtils.emptyIfNull(forbiddenEndpoints);
85+
}
7786
}
7887

88+
@Data
89+
public static class ApiEndpoint {
90+
private HttpMethod method;
91+
private String uri;
92+
}
93+
7994
@Data
8095
public static class Workspace {
8196

‎server/api-service/lowcoder-server/src/main/java/org/lowcoder/api/framework/security/SecurityConfig.java‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
import org.springframework.security.config.web.server.ServerHttpSecurity;
3535
import org.springframework.security.web.server.SecurityWebFilterChain;
3636
import org.springframework.security.web.server.ServerAuthenticationEntryPoint;
37+
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
3738
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers;
3839
import org.springframework.web.cors.CorsConfiguration;
3940
import org.springframework.web.cors.reactive.CorsConfigurationSource;
@@ -62,8 +63,17 @@ public class SecurityConfig {
6263
@Bean
6364
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
6465

65-
66-
http.cors()
66+
if (!commonConfig.getSecurity().getForbiddenEndpoints().isEmpty())
67+
{
68+
http.authorizeExchange()
69+
.matchers(
70+
commonConfig.getSecurity().getForbiddenEndpoints().stream()
71+
.map(apiEndpoint -> ServerWebExchangeMatchers.pathMatchers(apiEndpoint.getMethod(), apiEndpoint.getUri()))
72+
.toArray(size -> new ServerWebExchangeMatcher[size])
73+
).denyAll();
74+
}
75+
76+
http.cors()
6777
.configurationSource(buildCorsConfigurationSource())
6878
.and()
6979
.csrf().disable()
@@ -137,6 +147,7 @@ public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
137147
return http.build();
138148
}
139149

150+
140151
/**
141152
* enable CORS
142153
*/

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /