Changeset 950fa0d for src/main/java/edu/gjoko/schedlr/config/AppSecurityConfig.java

Timestamp:

05/24/23 23:18:47 (18 months ago)

Author:

Gjoko Kostadinov <gjoko.kostadinov@…>

Branches:

master

Children:

77205be

Parents:

8bcd64c

Message:

Periodic update

File:

• src/main/java/edu/gjoko/schedlr/config/AppSecurityConfig.java (modified) (3 diffs)

src/main/java/edu/gjoko/schedlr/config/AppSecurityConfig.java

@@ -10 +10 @@
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
-import org.springframework.security.config.core.GrantedAuthorityDefaults;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
-import org.springframework.security.web.access.AccessDeniedHandler;
 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+import org.springframework.security.web.authentication.logout.HeaderWriterLogoutHandler;
+import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler;
 import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
+import org.springframework.security.web.header.writers.ClearSiteDataHeaderWriter;
+
+import static org.springframework.security.web.header.writers.ClearSiteDataHeaderWriter.Directive.*;
 
 @Configuration
@@ -21 +24 @@
 @AllArgsConstructor
 public class AppSecurityConfig extends WebSecurityConfigurerAdapter {
+
+    private static final ClearSiteDataHeaderWriter.Directive[] SOURCE =
+            {CACHE, COOKIES, STORAGE, EXECUTION_CONTEXTS};
 
     private final PostgresUserDetailsService userDetailsService;
@@ -55 +61 @@
                 .defaultSuccessUrl("/homepage")
                 .and()
+                .logout(logout -> logout
+                        .logoutUrl("/logout")
+                        .logoutSuccessUrl("/login")
+                        .addLogoutHandler(new SecurityContextLogoutHandler())
+                        .addLogoutHandler(new HeaderWriterLogoutHandler(new ClearSiteDataHeaderWriter(SOURCE))))
                 .authorizeRequests()
                 .antMatchers("/login").permitAll()
+                .antMatchers("/logout").permitAll()
                 .antMatchers("/register_customer").permitAll()
                 .antMatchers("/register_business").permitAll()
                 .antMatchers("/api/nomenclatures/*").permitAll()
+                .antMatchers("/api/user/me").permitAll()
                 .antMatchers("/api/business").permitAll()
+                .antMatchers("/api/appointment").permitAll()
                 .antMatchers("/homepage").permitAll()
                 .antMatchers("/css/**").permitAll()