39 lines
1.7 KiB
Kotlin
39 lines
1.7 KiB
Kotlin
package com.android.trisolarisserver.security
|
|
|
|
import org.springframework.context.annotation.Bean
|
|
import org.springframework.context.annotation.Configuration
|
|
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity
|
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity
|
|
import org.springframework.security.config.http.SessionCreationPolicy
|
|
import org.springframework.security.web.SecurityFilterChain
|
|
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter
|
|
import org.springframework.security.web.authentication.HttpStatusEntryPoint
|
|
import org.springframework.http.HttpStatus
|
|
|
|
@Configuration(proxyBeanMethods = false)
|
|
@EnableMethodSecurity
|
|
class SecurityConfig(
|
|
private val firebaseAuthFilter: FirebaseAuthFilter
|
|
) {
|
|
@Bean
|
|
fun filterChain(http: HttpSecurity): SecurityFilterChain {
|
|
http
|
|
.csrf { it.disable() }
|
|
.sessionManagement { it.sessionCreationPolicy(SessionCreationPolicy.STATELESS) }
|
|
.authorizeHttpRequests {
|
|
it.requestMatchers("/", "/health", "/auth/**").permitAll()
|
|
it.anyRequest().authenticated()
|
|
}
|
|
.exceptionHandling {
|
|
it.authenticationEntryPoint(HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
|
|
it.accessDeniedHandler { _, response, _ ->
|
|
response.sendError(HttpStatus.UNAUTHORIZED.value(), "Unauthorized")
|
|
}
|
|
}
|
|
.httpBasic { it.disable() }
|
|
.formLogin { it.disable() }
|
|
.addFilterBefore(firebaseAuthFilter, UsernamePasswordAuthenticationFilter::class.java)
|
|
return http.build()
|
|
}
|
|
}
|