3030@ Order (1 ) // this ensures the forms security comes first
3131public class FormsSecurityConfig extends WebSecurityConfig {
3232
33- /**
34- * Remember me key for {@link TokenBasedRememberMeServices}
35- */
36- private static final String UNIQUE_SECRET_REMEMBER_ME_KEY = "secret" ;
33+ /**
34+ * Remember me key for {@link TokenBasedRememberMeServices}
35+ */
36+ private static final String UNIQUE_SECRET_REMEMBER_ME_KEY = "secret" ;
3737
38- /**
39- * We ensure the superclass configuration is being applied Take note the
40- * {@link FormsSecurityConfig} extends {@link WebSecurityConfig} which has
41- * configuration for the dg-toolkit/web module. We then apply ant matchers
42- * and ignore security for css/js/images resources, and wicket mounted
43- * resources
44- */
45- @ Override
46- public void configure (final WebSecurity web ) throws Exception {
47- super .configure (web );
48- web .ignoring ().antMatchers ("/ui/**" ,
49- "/img/**" , "/css*/**" , "/js*/**" , "/assets*/**" , "/wicket/resource/**/*.js" ,
50- "/wicket/resource/**/*.css" , "/wicket/resource/**/*.png" , "/wicket/resource/**/*.jpg" ,
51- "/wicket/resource/**/*.gif" , "/login/**" , "/forgotPassword/**" ,
38+ /**
39+ * We ensure the superclass configuration is being applied Take note the
40+ * {@link FormsSecurityConfig} extends {@link WebSecurityConfig} which has
41+ * configuration for the dg-toolkit/web module. We then apply ant matchers
42+ * and ignore security for css/js/images resources, and wicket mounted
43+ * resources
44+ */
45+ @ Override
46+ public void configure (final WebSecurity web ) throws Exception {
47+ super .configure (web );
48+ web .ignoring ().antMatchers ("/ui/**" ,
49+ "/img/**" , "/css*/**" , "/js*/**" , "/assets*/**" , "/wicket/resource/**/*.js" ,
50+ "/wicket/resource/**/*.css" , "/wicket/resource/**/*.png" , "/wicket/resource/**/*.jpg" ,
51+ "/wicket/resource/**/*.gif" , "/login/**" , "/forgotPassword/**" ,
5252 "/resources/**" , "/resources/public/**" );
53- }
53+ }
5454
55- /**
56- * This bean defines the same key in the {@link RememberMeAuthenticationProvider}
57- * @return
58- */
59- @ Bean
60- public AuthenticationProvider rememberMeAuthenticationProvider () {
61- return new RememberMeAuthenticationProvider (UNIQUE_SECRET_REMEMBER_ME_KEY );
62- }
55+ /**
56+ * This bean defines the same key in the {@link RememberMeAuthenticationProvider}
57+ * @return
58+ */
59+ @ Bean
60+ public AuthenticationProvider rememberMeAuthenticationProvider () {
61+ return new RememberMeAuthenticationProvider (UNIQUE_SECRET_REMEMBER_ME_KEY );
62+ }
6363
64- /**
65- * This bean configures the {@link TokenBasedRememberMeServices} with
66- * {@link CustomJPAUserDetailsService}
67- *
68- * @return
69- */
70- @ Bean
71- public AbstractRememberMeServices rememberMeServices () {
72- TokenBasedRememberMeServices rememberMeServices = new TokenBasedRememberMeServices (
73- UNIQUE_SECRET_REMEMBER_ME_KEY , customJPAUserDetailsService );
74- rememberMeServices .setAlwaysRemember (true );
75- return rememberMeServices ;
76- }
64+ /**
65+ * This bean configures the {@link TokenBasedRememberMeServices} with
66+ * {@link CustomJPAUserDetailsService}
67+ *
68+ * @return
69+ */
70+ @ Bean
71+ public AbstractRememberMeServices rememberMeServices () {
72+ TokenBasedRememberMeServices rememberMeServices = new TokenBasedRememberMeServices (
73+ UNIQUE_SECRET_REMEMBER_ME_KEY , customJPAUserDetailsService );
74+ rememberMeServices .setAlwaysRemember (true );
75+ return rememberMeServices ;
76+ }
7777
78- @ Override
79- protected void configure (final HttpSecurity http ) throws Exception {
80- super .configure (http );
78+ @ Override
79+ protected void configure (final HttpSecurity http ) throws Exception {
80+ super .configure (http );
8181
82- // we do not allow anyonymous token. When
83- // enabled this basically means any guest
84- // user will have an annoymous default role
85- http .anonymous ().disable ().
86- sessionManagement ().sessionCreationPolicy (SessionCreationPolicy .NEVER ).
87- //we let Wicket create and manage sessions, so we disable
88- //session creation by spring
89- and ().csrf ().disable (); // csrf protection interferes with some wicket stuff
82+ // we do not allow anyonymous token. When
83+ // enabled this basically means any guest
84+ // user will have an annoymous default role
85+ http .anonymous ().disable ().
86+ sessionManagement ().sessionCreationPolicy (SessionCreationPolicy .NEVER ).
87+ //we let Wicket create and manage sessions, so we disable
88+ //session creation by spring
89+ and ().csrf ().disable (); // csrf protection interferes with some wicket stuff
9090
91- // we enable http rememberMe cookie for autologin
92- // http.rememberMe().key(UNIQUE_SECRET_REMEMBER_ME_KEY);
91+ // we enable http rememberMe cookie for autologin
92+ // http.rememberMe().key(UNIQUE_SECRET_REMEMBER_ME_KEY);
9393
94- // resolved the error Refused to display * in a frame because it set
95- // 'X-Frame-Options' to 'DENY'.
96- http .headers ().contentTypeOptions ().and ().xssProtection ().and ().cacheControl ().and ()
97- .httpStrictTransportSecurity ().and ().frameOptions ().sameOrigin ();
94+ // resolved the error Refused to display * in a frame because it set
95+ // 'X-Frame-Options' to 'DENY'.
96+ http .headers ().contentTypeOptions ().and ().xssProtection ().and ().cacheControl ().and ()
97+ .httpStrictTransportSecurity ().and ().frameOptions ().sameOrigin ();
9898
99- }
99+ }
100100}
0 commit comments