|
23 | 23 | import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseType; |
24 | 24 | import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; |
25 | 25 | import org.springframework.security.config.annotation.web.builders.HttpSecurity; |
| 26 | +import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer; |
26 | 27 | import org.springframework.security.core.userdetails.User; |
27 | 28 | import org.springframework.security.core.userdetails.UserDetails; |
28 | 29 | import org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl; |
29 | 30 | import org.springframework.security.provisioning.JdbcUserDetailsManager; |
30 | 31 | import org.springframework.security.provisioning.UserDetailsManager; |
31 | 32 | import org.springframework.security.web.SecurityFilterChain; |
32 | | -import org.springframework.security.web.util.matcher.AntPathRequestMatcher; |
33 | 33 |
|
34 | 34 | import javax.sql.DataSource; |
35 | 35 |
|
@@ -71,27 +71,20 @@ public UserDetailsManager users(DataSource dataSource) { |
71 | 71 | } |
72 | 72 |
|
73 | 73 | @Bean |
74 | | - public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { |
75 | | - // @formatter:off |
76 | | - http |
77 | | - .authorizeHttpRequests() |
78 | | - .requestMatchers("/*", "/h2-console/**").permitAll() |
79 | | - .requestMatchers("/contacts/**").hasRole("USER") |
80 | | - .and() |
81 | | - .csrf() |
82 | | - .ignoringRequestMatchers("/h2-console/*") |
83 | | - .and() |
84 | | - .headers() |
85 | | - .frameOptions().sameOrigin() |
86 | | - .and() |
87 | | - .formLogin() |
88 | | - .defaultSuccessUrl("/contacts") |
89 | | - .and() |
90 | | - .logout() |
91 | | - .logoutRequestMatcher(new AntPathRequestMatcher("/logout")) |
92 | | - .logoutSuccessUrl("/"); |
93 | | - // @formatter:on |
| 74 | + SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { |
| 75 | + return http.authorizeHttpRequests(auth -> { |
| 76 | + auth.requestMatchers("/", "/error").permitAll(); |
| 77 | + auth.requestMatchers("/h2-console/**").permitAll(); |
| 78 | + auth.requestMatchers("/css/*").permitAll(); |
| 79 | + auth.requestMatchers("/favicon.ico", "favicon.svg").permitAll(); |
94 | 80 |
|
95 | | - return http.build(); |
| 81 | + auth.requestMatchers("/contacts/**").hasRole("USER"); |
| 82 | + |
| 83 | + auth.anyRequest().authenticated(); |
| 84 | + }) |
| 85 | + .csrf(csrf -> csrf.ignoringRequestMatchers("/h2-console/*")) |
| 86 | + .headers(headers -> headers.frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)) |
| 87 | + .formLogin(formLogin -> formLogin.defaultSuccessUrl("/contacts")) |
| 88 | + .logout(formLogout -> formLogout.logoutSuccessUrl("/")).build(); |
96 | 89 | } |
97 | 90 | } |
0 commit comments