@@ -12,7 +12,6 @@ import org.springframework.security.authentication.dao.DaoAuthenticationProvider
|
||||
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
||||
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
|
||||
import org.springframework.security.core.userdetails.UserDetailsService;
|
||||
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
|
||||
import org.springframework.security.web.SecurityFilterChain;
|
||||
@@ -52,17 +51,6 @@ public class WebSecurityConfig {
|
||||
this.applicationContext = applicationContext;
|
||||
}
|
||||
|
||||
/**
|
||||
* Exclude truly static assets from the security filter chain entirely.
|
||||
* H2 console and Druid monitoring are NOT excluded here — they are secured via filterChain.
|
||||
*/
|
||||
@Bean
|
||||
public WebSecurityCustomizer webSecurityCustomizer() {
|
||||
return web -> web.ignoring().requestMatchers(
|
||||
"/css/**", "/js/**", "/images/**", "/static/**", "/favicon.ico"
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Main security filter chain.
|
||||
*
|
||||
@@ -98,7 +86,8 @@ public class WebSecurityConfig {
|
||||
http.authorizeHttpRequests(auth -> {
|
||||
// Publicly accessible
|
||||
auth.requestMatchers(
|
||||
"/login/**", "/register", "/registerDo", "/initUserData",
|
||||
"/css/**", "/js/**", "/images/**", "/static/**", "/favicon.ico",
|
||||
"/login/**", "/register", "/registerDo", "/initUserData",
|
||||
"/", "/main", "/index", "/getdiscussionsbyid",
|
||||
// SpringDoc OpenAPI UI and spec endpoint (developer tools, no sensitive data)
|
||||
"/swagger-ui/**", "/swagger-ui.html", "/v3/api-docs/**"
|
||||
|
||||
Reference in New Issue
Block a user