Commit: 690c1f6

Commit Details

SHA	`690c1f6ce426c62c29e87ac132dda0f8125192ff`
Tree	`5a67fd55b56735ab4e469c7d06c1c73c4c2b4c20`
Author	<f69e50@finnacloud.com> 1766368110 +0300
Committer	<f69e50@finnacloud.com> 1766368110 +0300
Message	initialize backend structure with controllers, DTOs, and configuration files
GPG Signature	-----BEGIN PGP SIGNATURE----- iQJSBAABCAA8FiEEWJb139mJI+vZ81KkoAIVSUsXI0oFAmlIo24eHHNvcGhpYS5l cmFzbGFuQGZpbm5hY2xvdWQuY29tAAoJEKACFUlLFyNKwXYP/RvWx8mxXoZbKEVA wQFC9UnzcoL/lElB5QMr9opKzRv4uGgFkKMDhbSnqE6NoET5H5VanOFQ9u5a4Khi 9PBTLIEBjbEqA1trC+aTDk3EplVtQYYbSn19CdMSCW7FXJNSg0IiyWKA44iH8Ts0 Xcxh59m6WcwvRDhxQDy6hCXqUa9ISNNk75KRnJS/qRGIEy94DwUYxVfCJpAfzyVu VmdinE6kZM2GDj8MBTPQTzi6hMf/e9CcAg51tf4oNtd9tnW8QKpTsPsFy434VUDh Vxtv/oAJ5tuTIprs2BSnyZ6Kb8RDwDdmQyuKjZMUIwZTH/TCE85SZFf5sa5tpYOH 2KekT52ffZgKw/DUtpNosW6qeHgCJlSvwY7BW7M90X5xJuahrKS04lEDBO04cIRn bg0ayPFTp7Idhl1OuTRhWS6e344g44mJ/9sZK1sXd/0U8OKBbytk35AnCIPCEdSX 8vgjqBR9Wt3A/Kel5j2VcUFDhrAR72a9lJiQHNBicvcVu9Nd41vDnEwUDdNQv6Uc 6omEz3pkVkq+89/eW1KQM8LvrIuGQ/wIUgykvCNSCQ5oba2fjtAXzI+SmxpeCWOz jTKZOEJyhIQE7uvaUj6/0D2JwlxbMG27fcUN7N3aKv6mSVP7hYnHaUbRLQ+f8/xU VfU776FkUXS+4CfSooHtu+ioul9O =ZuqE -----END PGP SIGNATURE----- ✓ Verified

File: src/main/java/com/paymentlink/config/SecurityConfig.java

← Back to commit | View | Raw | History | Compare

      
      package com.paymentlink.config;
    
      import org.springframework.context.annotation.Bean;
    
      import org.springframework.context.annotation.Configuration;
    
      import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    
      import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    
      import org.springframework.security.web.SecurityFilterChain;
    
      import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
    
      import org.springframework.security.web.csrf.CsrfToken;
    
      import org.springframework.security.web.firewall.HttpFirewall;
    
      import org.springframework.security.web.firewall.StrictHttpFirewall;
    
      import org.springframework.web.cors.CorsConfiguration;
    
      import org.springframework.web.cors.CorsConfigurationSource;
    
      import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
    
      import jakarta.servlet.http.HttpServletRequest;
    
      import jakarta.servlet.http.HttpServletResponse;
    
      import org.springframework.security.web.csrf.CsrfTokenRequestHandler;
    
      import org.springframework.security.web.csrf.XorCsrfTokenRequestAttributeHandler;
    
      import java.util.Arrays;
    
      import java.util.function.Supplier;
    
      @Configuration
    
      @EnableWebSecurity
    
      public class SecurityConfig {
    
          @Bean
    
          public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    
              http
    
                  // Disable authentication - we want permitAll
    
                  .authorizeHttpRequests(auth -> auth
    
                      .anyRequest().permitAll()
    
                  )
    
                  // Disable CSRF for easier testing (re-enable in production)
    
                  .csrf(csrf -> csrf.disable())
    
                  // CORS Configuration
    
                  .cors(cors -> cors.configurationSource(corsConfigurationSource()));
    
              return http.build();
    
          }
    
          /**
    
           * Custom CSRF token request handler for SPA
    
           */
    
          static final class SpaCsrfTokenRequestHandler implements CsrfTokenRequestHandler {
    
              private final CsrfTokenRequestHandler delegate = new XorCsrfTokenRequestAttributeHandler();
    
              @Override
    
              public void handle(HttpServletRequest request, HttpServletResponse response,
    
                                Supplier<CsrfToken> csrfToken) {
    
                  delegate.handle(request, response, csrfToken);
    
              }
    
              @Override
    
              public String resolveCsrfTokenValue(HttpServletRequest request, CsrfToken csrfToken) {
    
                  String headerValue = request.getHeader(csrfToken.getHeaderName());
    
                  return (headerValue != null) ? headerValue : delegate.resolveCsrfTokenValue(request, csrfToken);
    
              }
    
          }
    
          /**
    
           * CORS Configuration
    
           */
    
          @Bean
    
          public CorsConfigurationSource corsConfigurationSource() {
    
              CorsConfiguration configuration = new CorsConfiguration();
    
              configuration.setAllowedOrigins(Arrays.asList("*"));
    
              configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
    
              configuration.setAllowedHeaders(Arrays.asList("*"));
    
              configuration.setAllowCredentials(false);
    
              UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    
              source.registerCorsConfiguration("/**", configuration);
    
              return source;
    
          }
    
          /**
    
           * Custom HTTP Firewall to allow WebDAV methods (PROPFIND, etc.)
    
           * This prevents RequestRejectedException logs from IDEs like WebStorm
    
           */
    
          @Bean
    
          public HttpFirewall allowWebDavHttpFirewall() {
    
              StrictHttpFirewall firewall = new StrictHttpFirewall();
    
              // Allow standard HTTP methods plus WebDAV methods
    
              firewall.setAllowedHttpMethods(Arrays.asList(
    
                  "GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD",
    
                  // WebDAV methods used by IDEs
    
                  "PROPFIND", "PROPPATCH", "REPORT", "LOCK", "UNLOCK",
    
                  "COPY", "MOVE", "MKCOL"
    
              ));
    
              return firewall;
    
          }
    
      }

1	package com.paymentlink.config;
2
3	import org.springframework.context.annotation.Bean;
4	import org.springframework.context.annotation.Configuration;
5	import org.springframework.security.config.annotation.web.builders.HttpSecurity;
6	import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
7	import org.springframework.security.web.SecurityFilterChain;
8	import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
9	import org.springframework.security.web.csrf.CsrfToken;
10	import org.springframework.security.web.firewall.HttpFirewall;
11	import org.springframework.security.web.firewall.StrictHttpFirewall;
12	import org.springframework.web.cors.CorsConfiguration;
13	import org.springframework.web.cors.CorsConfigurationSource;
14	import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
15
16	import jakarta.servlet.http.HttpServletRequest;
17	import jakarta.servlet.http.HttpServletResponse;
18	import org.springframework.security.web.csrf.CsrfTokenRequestHandler;
19	import org.springframework.security.web.csrf.XorCsrfTokenRequestAttributeHandler;
20
21	import java.util.Arrays;
22	import java.util.function.Supplier;
23
24	@Configuration
25	@EnableWebSecurity
26	public class SecurityConfig {
27
28	@Bean
29	public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
30	http
31	// Disable authentication - we want permitAll
32	.authorizeHttpRequests(auth -> auth
33	.anyRequest().permitAll()
34	)
35	// Disable CSRF for easier testing (re-enable in production)
36	.csrf(csrf -> csrf.disable())
37	// CORS Configuration
38	.cors(cors -> cors.configurationSource(corsConfigurationSource()));
39
40	return http.build();
41	}
42
43	/**
44	* Custom CSRF token request handler for SPA
45	*/
46	static final class SpaCsrfTokenRequestHandler implements CsrfTokenRequestHandler {
47	private final CsrfTokenRequestHandler delegate = new XorCsrfTokenRequestAttributeHandler();
48
49	@Override
50	public void handle(HttpServletRequest request, HttpServletResponse response,
51	Supplier<CsrfToken> csrfToken) {
52	delegate.handle(request, response, csrfToken);
53	}
54
55	@Override
56	public String resolveCsrfTokenValue(HttpServletRequest request, CsrfToken csrfToken) {
57	String headerValue = request.getHeader(csrfToken.getHeaderName());
58	return (headerValue != null) ? headerValue : delegate.resolveCsrfTokenValue(request, csrfToken);
59	}
60	}
61
62	/**
63	* CORS Configuration
64	*/
65	@Bean
66	public CorsConfigurationSource corsConfigurationSource() {
67	CorsConfiguration configuration = new CorsConfiguration();
68	configuration.setAllowedOrigins(Arrays.asList("*"));
69	configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
70	configuration.setAllowedHeaders(Arrays.asList("*"));
71	configuration.setAllowCredentials(false);
72
73	UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
74	source.registerCorsConfiguration("/**", configuration);
75	return source;
76	}
77
78	/**
79	* Custom HTTP Firewall to allow WebDAV methods (PROPFIND, etc.)
80	* This prevents RequestRejectedException logs from IDEs like WebStorm
81	*/
82	@Bean
83	public HttpFirewall allowWebDavHttpFirewall() {
84	StrictHttpFirewall firewall = new StrictHttpFirewall();
85
86	// Allow standard HTTP methods plus WebDAV methods
87	firewall.setAllowedHttpMethods(Arrays.asList(
88	"GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD",
89	// WebDAV methods used by IDEs
90	"PROPFIND", "PROPPATCH", "REPORT", "LOCK", "UNLOCK",
91	"COPY", "MOVE", "MKCOL"
92	));
93
94	return firewall;
95	}
96	}
97
98

backend

Commit: 690c1f6

Commit Details

File: src/main/java/com/paymentlink/config/SecurityConfig.java