Changeset 950fa0d for src/main/java/edu/gjoko/schedlr/config

Timestamp:

05/24/23 23:18:47 (18 months ago)

Author:

Gjoko Kostadinov <gjoko.kostadinov@…>

Branches:

master

Children:

77205be

Parents:

8bcd64c

Message:

Periodic update

Location:

src/main/java/edu/gjoko/schedlr/config

Files:

• AppFilter.java (modified) (2 diffs)
• AppSecurityConfig.java (modified) (3 diffs)

src/main/java/edu/gjoko/schedlr/config/AppFilter.java

@@ -10 +10 @@
 import org.springframework.web.filter.GenericFilterBean;
 
-import javax.servlet.FilterChain;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
+import javax.servlet.*;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -75 +72 @@
                             break;
                     }
-                    if(page != null && !page.trim().isEmpty()) {
+                    if(page != null && !page.trim().isEmpty() && !DispatcherType.ERROR.equals(servletRequest.getDispatcherType())) {
                         servletRequest.getRequestDispatcher(page).forward(servletRequest, servletResponse);
                         return;

src/main/java/edu/gjoko/schedlr/config/AppSecurityConfig.java

@@ -10 +10 @@
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
-import org.springframework.security.config.core.GrantedAuthorityDefaults;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
-import org.springframework.security.web.access.AccessDeniedHandler;
 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+import org.springframework.security.web.authentication.logout.HeaderWriterLogoutHandler;
+import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
 import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
+import org.springframework.security.web.header.writers.ClearSiteDataHeaderWriter;
+
+import static org.springframework.security.web.header.writers.ClearSiteDataHeaderWriter.Directive.*;
 
 @Configuration
@@ -21 +24 @@
 @AllArgsConstructor
 public class AppSecurityConfig extends WebSecurityConfigurerAdapter {
+
+    private static final ClearSiteDataHeaderWriter.Directive[] SOURCE =
+            {CACHE, COOKIES, STORAGE, EXECUTION_CONTEXTS};
 
     private final PostgresUserDetailsService userDetailsService;
@@ -55 +61 @@
                 .defaultSuccessUrl("/homepage")
                 .and()
+                .logout(logout -> logout
+                        .logoutUrl("/logout")
+                        .logoutSuccessUrl("/login")
+                        .addLogoutHandler(new SecurityContextLogoutHandler())
+                        .addLogoutHandler(new HeaderWriterLogoutHandler(new ClearSiteDataHeaderWriter(SOURCE))))
                 .authorizeRequests()
                 .antMatchers("/login").permitAll()
+                .antMatchers("/logout").permitAll()
                 .antMatchers("/register_customer").permitAll()
                 .antMatchers("/register_business").permitAll()
                 .antMatchers("/api/nomenclatures/*").permitAll()
+                .antMatchers("/api/user/me").permitAll()
                 .antMatchers("/api/business").permitAll()
+                .antMatchers("/api/appointment").permitAll()
                 .antMatchers("/homepage").permitAll()
                 .antMatchers("/css/**").permitAll()