|
@@ -1,9 +1,10 @@
|
|
|
package com.its.wthr.webapp.config;
|
|
|
|
|
|
-import com.its.wthr.webapp.config.service.UserService;
|
|
|
import com.its.wthr.webapp.security.SessionListener;
|
|
|
+import com.its.wthr.webapp.service.UserService;
|
|
|
import org.springframework.context.annotation.Bean;
|
|
|
import org.springframework.context.annotation.Configuration;
|
|
|
+import org.springframework.http.HttpMethod;
|
|
|
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
|
|
|
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
|
|
import org.springframework.security.config.annotation.web.builders.WebSecurity;
|
|
@@ -19,65 +20,80 @@ import javax.servlet.http.HttpSessionListener;
|
|
|
@EnableWebSecurity
|
|
|
@Configuration
|
|
|
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
|
|
|
- private final UserService userService;
|
|
|
+ private final UserService userService;
|
|
|
|
|
|
- public WebSecurityConfig(UserService userService) {
|
|
|
- this.userService = userService;
|
|
|
- }
|
|
|
+ public WebSecurityConfig(UserService userService) {
|
|
|
+ this.userService = userService;
|
|
|
+ }
|
|
|
|
|
|
- public void configure(WebSecurity web) throws Exception {
|
|
|
- web.ignoring().antMatchers(new String[]{"/css/**", "/js/**", "/img/**", "/lib/**"});
|
|
|
- }
|
|
|
+ @Override
|
|
|
+ public void configure(WebSecurity web) throws Exception {
|
|
|
+ web.ignoring().antMatchers("/favicon.ico");
|
|
|
+ web.ignoring().antMatchers(new String[]{"/css/**", "/js/**", "/img/**", "/lib/**"});
|
|
|
|
|
|
- protected void configure(HttpSecurity http) throws Exception {
|
|
|
-
|
|
|
- http.authorizeRequests()
|
|
|
- .antMatchers(new String[]{"/index"})
|
|
|
- .hasRole("ADMIN")
|
|
|
- .antMatchers(new String[]{"/**"})
|
|
|
- .hasRole("ADMIN")
|
|
|
- .and()
|
|
|
- .formLogin()
|
|
|
- .loginPage("/login")
|
|
|
- .defaultSuccessUrl("/index")
|
|
|
- .failureUrl("/denied")
|
|
|
- .permitAll()
|
|
|
- .and()
|
|
|
- .logout()
|
|
|
- .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
|
|
|
- .logoutSuccessUrl("/login").invalidateHttpSession(true)
|
|
|
- .deleteCookies()
|
|
|
- .and()
|
|
|
- .exceptionHandling()
|
|
|
- .accessDeniedPage("/denied");
|
|
|
-
|
|
|
- http
|
|
|
- .csrf()
|
|
|
- .disable();
|
|
|
-
|
|
|
- http
|
|
|
- .sessionManagement()
|
|
|
- .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
|
|
|
- .invalidSessionUrl("/login")
|
|
|
- .sessionFixation()
|
|
|
- .migrateSession()
|
|
|
- .maximumSessions(5)
|
|
|
- .maxSessionsPreventsLogin(true)
|
|
|
- .expiredUrl("/login")
|
|
|
- .sessionRegistry(this.sessionRegistry());
|
|
|
- }
|
|
|
+ web.ignoring().antMatchers(HttpMethod.GET, "/api/**"); // GET Method 는 모두 통과
|
|
|
+ web.ignoring().antMatchers(HttpMethod.POST, "/api/**"); // GET Method 는 모두 통과
|
|
|
+ web.ignoring().antMatchers(HttpMethod.PUT, "/api/**"); // GET Method 는 모두 통과
|
|
|
+ web.ignoring().antMatchers(HttpMethod.DELETE, "/api/**"); // GET Method 는 모두 통과
|
|
|
+ }
|
|
|
|
|
|
- protected void configure(AuthenticationManagerBuilder auth) throws Exception {
|
|
|
- auth.userDetailsService(this.userService);
|
|
|
- }
|
|
|
+ @Override
|
|
|
+ protected void configure(HttpSecurity http) throws Exception {
|
|
|
|
|
|
- @Bean
|
|
|
- public SessionRegistry sessionRegistry() {
|
|
|
- return new SessionRegistryImpl();
|
|
|
- }
|
|
|
+ http.authorizeRequests()
|
|
|
+ // SWAGGER 권한 설정
|
|
|
+ .antMatchers("/swagger-ui.html", "/swagger/**", "/swagger-resources/**", "/webjars/**", "/v2/api-docs").permitAll()
|
|
|
+ // 웹소켓 권한 설정하지
|
|
|
+ .antMatchers("/ws/**").permitAll()
|
|
|
+ .antMatchers("/api/**").permitAll()
|
|
|
+ .antMatchers(new String[]{"/index"})
|
|
|
+ .hasRole("ADMIN")
|
|
|
+ .antMatchers(new String[]{"/**"})
|
|
|
+ .hasRole("ADMIN")
|
|
|
+ .and()
|
|
|
+ .formLogin()
|
|
|
+ .loginPage("/login")
|
|
|
+ .defaultSuccessUrl("/index")
|
|
|
+ .failureUrl("/denied")
|
|
|
+ .permitAll()
|
|
|
+ .and()
|
|
|
+ .logout()
|
|
|
+ .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
|
|
|
+ .logoutSuccessUrl("/login").invalidateHttpSession(true)
|
|
|
+ .deleteCookies()
|
|
|
+ .and()
|
|
|
+ .exceptionHandling()
|
|
|
+ .accessDeniedPage("/denied");
|
|
|
+
|
|
|
+ http
|
|
|
+ .csrf()
|
|
|
+ .disable();
|
|
|
+
|
|
|
+ http
|
|
|
+ .sessionManagement()
|
|
|
+ .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
|
|
|
+ .invalidSessionUrl("/login")
|
|
|
+ .sessionFixation()
|
|
|
+ .migrateSession()
|
|
|
+ .maximumSessions(5)
|
|
|
+ .maxSessionsPreventsLogin(true)
|
|
|
+ .expiredUrl("/login")
|
|
|
+ .sessionRegistry(this.sessionRegistry());
|
|
|
+ }
|
|
|
+
|
|
|
+ protected void configure(AuthenticationManagerBuilder auth) throws Exception {
|
|
|
+ auth.userDetailsService(this.userService);
|
|
|
+ }
|
|
|
+
|
|
|
+ @Bean
|
|
|
+ public SessionRegistry sessionRegistry() {
|
|
|
+ return new SessionRegistryImpl();
|
|
|
+ }
|
|
|
+
|
|
|
+ @Bean
|
|
|
+ public HttpSessionListener httpSessionListener() {
|
|
|
+ return new SessionListener();
|
|
|
+ }
|
|
|
+
|
|
|
+}
|
|
|
|
|
|
- @Bean
|
|
|
- public HttpSessionListener httpSessionListener() {
|
|
|
- return new SessionListener();
|
|
|
- }
|
|
|
-}
|