Merge pull request #79 from pajimene/develop

(Microservices) Update Spring Cloud Boot and security bug fix

Author: ssarmokadam

modules/microservices/microservice-archetype/src/main/resources/archetype-resources/pom.xml

@@ -264,7 +264,7 @@
 
     <dependency>
       <groupId>org.springframework.boot</groupId>
-      <artifactId>spring-boot-starter-ws</artifactId>
+      <artifactId>spring-boot-starter-web-services</artifactId>
     </dependency>
 
     <dependency>

modules/microservices/microservice-archetype/src/main/resources/archetype-resources/src/main/java/general/configuration/ServletInitializer.java

@@ -5,7 +5,7 @@
 
 import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
 import org.springframework.boot.builder.SpringApplicationBuilder;
-import org.springframework.boot.context.web.SpringBootServletInitializer;
+import org.springframework.boot.web.support.SpringBootServletInitializer;
 import org.springframework.context.annotation.Configuration;
 
 import ${package}.SpringBootApp;

modules/microservices/microservice-archetype/src/main/resources/archetype-resources/src/main/java/general/configuration/WebSecurityConfig.java

@@ -4,6 +4,7 @@
 package ${package}.general.configuration;
 
 import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpMethod;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
@@ -28,11 +29,13 @@ public JsonWebTokenUtility getJsonWebTokenUtility() {
   @Override
   protected void setupAuthorization(HttpSecurity http) throws Exception {
 
-  //Unsecure resources (triggers for actuator and more)
+    //Unsecure resources (triggers for actuator and more)
     String[] unsecuredResources = new String[] { "/health", "/info", "/metrics", "/trace", "/refresh" };
 
     http.authorizeRequests()
-        // authenticate all other requests
+        //allow Options request
+        .antMatchers(HttpMethod.OPTIONS).permitAll()
+        //allow unsecure resources
         .antMatchers(unsecuredResources).permitAll()
         // authenticate all other requests
         .anyRequest().authenticated();

modules/microservices/microservice-archetype/src/main/resources/archetype-resources/src/main/java/general/configuration/api/AbstractServiceConfig.java

@@ -17,7 +17,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Value;
-import org.springframework.boot.context.embedded.ServletRegistrationBean;
+import org.springframework.boot.web.servlet.ServletRegistrationBean;
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;

modules/microservices/microservice-archetype/src/main/resources/archetype-resources/src/main/java/general/configuration/api/AbstractWebConfig.java

@@ -8,7 +8,7 @@
 import org.apache.catalina.filters.SetCharacterEncodingFilter;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.AutowireCapableBeanFactory;
-import org.springframework.boot.context.embedded.FilterRegistrationBean;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
 import org.springframework.context.annotation.Bean;
 
 import io.oasp.module.logging.common.api.DiagnosticContextFacade;

modules/microservices/microservices/src/main/java/com/capgemini/devonfw/microservices/configuration/jwt/JsonWebTokenUtility.java

@@ -3,11 +3,11 @@
 import java.security.Key;
 import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Base64;
 import java.util.Date;
 import java.util.List;
 
 import javax.crypto.spec.SecretKeySpec;
+import javax.xml.bind.DatatypeConverter;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -98,7 +98,7 @@ public final UserDetailsJsonWebTokenAbstract retrieveUserDetails(String token) {
   @Value("${jwt.encodedKey}")
   public final void setEncodedKey(String encodedKey) {
 
-    byte[] decodedKey = Base64.getDecoder().decode(encodedKey);
+    byte[] decodedKey = DatatypeConverter.parseBase64Binary(encodedKey);
     this.secretKey = new SecretKeySpec(decodedKey, SIGNATURE_ALGORITHM.getJcaName());
 
   }

modules/microservices/pom.xml

@@ -14,7 +14,7 @@
   <description>Devonfw microservices archetypes and module</description>
 
   <properties>
-    <spring.cloud.boot.version>Brixton.SR7</spring.cloud.boot.version>
+        <spring.cloud.boot.version>Dalston.SR4</spring.cloud.boot.version>
   </properties>
 
   <modules>