Fix bad security configuration
continuous-integration/drone/push Build is passing Details

This commit is contained in:
william 2021-12-07 21:48:28 -05:00
parent 96b3582a93
commit 3220dc39ce
2 changed files with 3 additions and 1 deletions

View File

@ -53,6 +53,7 @@ class JwtAuthenticationFilter(
val userDetails = auth.principal as UserDetails
val token = jwtService.buildJwt(userDetails)
response.addHeader("Access-Control-Expose-Headers", authorizationCookieName)
response.addHeader(authorizationCookieName, "Bearer $token")
response.addCookie(authorizationCookieName, "Bearer$token") {
httpOnly = true

View File

@ -89,8 +89,9 @@ abstract class BaseSecurityConfig(
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
.and()
.authorizeRequests()
.antMatchers("/api/config/**").permitAll() // Allow access to logo and icon
.antMatchers("/api/login").permitAll() // Allow access to login
.antMatchers("**").fullyAuthenticated()
.antMatchers("/api/login").permitAll()
if (debugMode) {
http