From cf3d50c6d96ef23ff78b7dcadd77dc7fa506ca65 Mon Sep 17 00:00:00 2001 From: myh Date: Sun, 3 Dec 2023 23:40:45 +0800 Subject: [PATCH] Spring Security configuration --- ...rityConfigure.java => SecurityConfig.java} | 21 ++++++++++++------- src/main/resources/application.properties | 1 + 2 files changed, 14 insertions(+), 8 deletions(-) rename src/main/java/com/example/springdemo/security/{DefaultSecurityConfigure.java => SecurityConfig.java} (50%) diff --git a/src/main/java/com/example/springdemo/security/DefaultSecurityConfigure.java b/src/main/java/com/example/springdemo/security/SecurityConfig.java similarity index 50% rename from src/main/java/com/example/springdemo/security/DefaultSecurityConfigure.java rename to src/main/java/com/example/springdemo/security/SecurityConfig.java index da2dcff..c2228d3 100644 --- a/src/main/java/com/example/springdemo/security/DefaultSecurityConfigure.java +++ b/src/main/java/com/example/springdemo/security/SecurityConfig.java @@ -4,6 +4,8 @@ import org.jetbrains.annotations.NotNull; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.Customizer; +import org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication; +import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; @@ -12,18 +14,21 @@ import org.springframework.security.web.SecurityFilterChain; @Configuration @EnableWebSecurity // Enable Spring Security -public class DefaultSecurityConfigure { +@EnableGlobalAuthentication // Enable Spring Security's global authentication configuration +@EnableMethodSecurity(prePostEnabled = true) // Enable Spring Security's method security +public class SecurityConfig { @Bean - public SecurityFilterChain defaultSecurityFilterChain(@NotNull HttpSecurity http) throws Exception { - var ignoreUrls = new String[]{""}; - var authedUrls = new String[]{"/users"}; - http.authorizeHttpRequests( - (req) -> req.requestMatchers(ignoreUrls).permitAll() - ) + public SecurityFilterChain SecurityFilterChain(@NotNull HttpSecurity http) throws Exception { + var ignoreUrls = new String[]{"/login", "/logout", "/error"}; + var authedUrls = new String[]{"/users/*/**"}; + http .authorizeHttpRequests( - (req) -> req.requestMatchers(authedUrls).authenticated() + (request) -> request + .requestMatchers(authedUrls).authenticated() // authenticate all requests to authedUrls + .requestMatchers(ignoreUrls).permitAll() // permit all requests to ignoreUrls ) .formLogin(Customizer.withDefaults()) + .httpBasic(Customizer.withDefaults()) .csrf(AbstractHttpConfigurer::disable) .logout(LogoutConfigurer::permitAll); return http.build(); diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties index 8a8d4eb..b047834 100644 --- a/src/main/resources/application.properties +++ b/src/main/resources/application.properties @@ -14,6 +14,7 @@ spring.jpa.show-sql=true spring.jpa.properties.hibernate.format_sql=true spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.SQLServerDialect spring.jpa.hibernate.naming.physical-strategy=org.hibernate.boot.model.naming.PhysicalNamingStrategyStandardImpl +spring.jpa.properties.hibernate.enable_lazy_load_no_trans=true # spring security config spring.security.user.name=anchor spring.security.user.password=20172 \ No newline at end of file