66 lines
2.7 KiB
Java
66 lines
2.7 KiB
Java
package com.billpaymentservice.bbps.config;
|
|
|
|
import java.util.Arrays;
|
|
|
|
import org.springframework.context.annotation.Bean;
|
|
import org.springframework.context.annotation.Configuration;
|
|
import org.springframework.http.HttpMethod;
|
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
|
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
|
import org.springframework.security.config.http.SessionCreationPolicy;
|
|
import org.springframework.security.web.SecurityFilterChain;
|
|
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
|
|
import org.springframework.web.cors.CorsConfiguration;
|
|
import org.springframework.web.cors.CorsConfigurationSource;
|
|
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
|
|
|
|
@Configuration
|
|
@EnableWebSecurity
|
|
public class SecurityConfig {
|
|
|
|
private final JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;
|
|
|
|
private final JwtFilter jwtFilter;
|
|
|
|
public SecurityConfig(JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint, JwtFilter jwtFilter) {
|
|
this.jwtAuthenticationEntryPoint = jwtAuthenticationEntryPoint;
|
|
this.jwtFilter = jwtFilter;
|
|
}
|
|
|
|
@Bean
|
|
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
|
|
|
|
http.csrf(csrf -> csrf.disable()).cors(cors -> cors.configurationSource(corsConfigurationSource()))
|
|
.authorizeHttpRequests(auth -> auth
|
|
.requestMatchers("/auth/**",
|
|
"/v3/api-docs/**",
|
|
"/swagger-ui/**",
|
|
"/swagger-ui.html",
|
|
"/swagger-resources/**",
|
|
"/webjars/**",
|
|
"/error")
|
|
.permitAll().requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
|
|
.anyRequest().authenticated())
|
|
.exceptionHandling(ex -> ex.authenticationEntryPoint(jwtAuthenticationEntryPoint))
|
|
.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
|
|
|
|
http.addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
|
|
|
|
return http.build();
|
|
}
|
|
|
|
@Bean
|
|
public CorsConfigurationSource corsConfigurationSource() {
|
|
CorsConfiguration config = new CorsConfiguration();
|
|
config.setAllowedOrigins(Arrays.asList("*")); // Or use specific origin like "http://localhost:4200"
|
|
config.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
|
|
config.setAllowedHeaders(Arrays.asList("*"));
|
|
config.setAllowCredentials(false); // true only if you're sending cookies
|
|
|
|
// Use UrlBasedCorsConfigurationSource as it implements CorsConfigurationSource
|
|
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
|
|
source.registerCorsConfiguration("/**", config); // Apply CORS to all paths
|
|
return source; // Return as CorsConfigurationSource
|
|
}
|
|
}
|