List of usage examples for org.springframework.security.web.util.matcher AntPathRequestMatcher AntPathRequestMatcher
public AntPathRequestMatcher(String pattern)
From source file:com.isalnikov.config.SecurityConfig.java
@Override protected void configure(HttpSecurity http) throws Exception { http.addFilterBefore(authorizationFilter(), UserAuthorizationFilter.class); http.authorizeRequests()//from w w w. j av a2 s . c om //http://www.webremeslo.ru/html/glava10.html .antMatchers("/page**").permitAll() .antMatchers("/login").permitAll().antMatchers("/user").hasRole("USER").antMatchers("/csrf") .hasRole("USER").anyRequest().authenticated().and().formLogin() // default login jsp //.failureUrl("/login") //.failureHandler((new SimpleUrlAuthenticationFailureHandler()) .permitAll().and().logout() //default logout jsp .logoutRequestMatcher(new AntPathRequestMatcher("/logout")) // .deleteCookies("JSESSIONID,SPRING_SECURITY_REMEMBER_ME_COOKIE") .permitAll(); http.sessionManagement().maximumSessions(1).and().invalidSessionUrl("/login"); // http // .headers() // .frameOptions().sameOrigin() // .httpStrictTransportSecurity().disable(); //http.exceptionHandling().authenticationEntryPoint(null); http.headers().addHeaderWriter(new StaticHeadersWriter("X-Content-Security-Policy", "default-src 'self'")) .addHeaderWriter(new StaticHeadersWriter("X-WebKit-CSP", "default-src 'self'")); }
From source file:org.meruvian.yama.webapi.config.SecurityConfig.java
@Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests().antMatchers("/").permitAll().antMatchers("/oauth/authorize").fullyAuthenticated() .and().formLogin().loginPage(LOGIN_PAGE_URL).loginProcessingUrl(LOGIN_PROCESSING_URL) .usernameParameter("username").passwordParameter("password").defaultSuccessUrl(LOGIN_SUCCESS_URL) .failureUrl(LOGIN_FAILURE_URL).and().logout().logoutUrl(LOGOUT_URL) .logoutSuccessUrl(LOGOUT_SUCCESS_URL).invalidateHttpSession(true).and().rememberMe() .userDetailsService(userDetailsService).and().sessionManagement() .sessionCreationPolicy(SessionCreationPolicy.ALWAYS).and().csrf() .requireCsrfProtectionMatcher(new AntPathRequestMatcher("/oauth/authorize")).disable(); }
From source file:eu.openanalytics.WebSecurityConfig.java
@Override protected void configure(HttpSecurity http) throws Exception { http//from www. j av a 2s.com // must disable or handle in proxy .csrf().disable() // disable X-Frame-Options .headers().frameOptions().sameOrigin(); if (hasAuth(environment)) { // Limit access to the app pages http.authorizeRequests().antMatchers("/login").permitAll(); for (ShinyApp app : appService.getApps()) { String[] appRoles = appService.getAppRoles(app.getName()); if (appRoles != null && appRoles.length > 0) http.authorizeRequests().antMatchers("/app/" + app.getName()).hasAnyRole(appRoles); } // Limit access to the admin pages http.authorizeRequests().antMatchers("/admin").hasAnyRole(userService.getAdminRoles()); // All other pages are available to authenticated users http.authorizeRequests().anyRequest().fullyAuthenticated(); http.formLogin().loginPage("/login").and().logout() .logoutRequestMatcher(new AntPathRequestMatcher("/logout")).logoutSuccessHandler(logoutHandler) .logoutSuccessUrl("/login"); } }
From source file:org.shaigor.rest.retro.security.gateway.config.OAuth2SecurityConfigurer.java
@Override public void configure(HttpSecurity http) throws Exception { http.authorizeRequests().antMatchers("/login.jsp").permitAll().and().authorizeRequests() .expressionHandler(expressionHandler).anyRequest().hasRole("USER").and().authorizeRequests() .regexMatchers(HttpMethod.GET, "/word/list(\\?.*)?") .access("#oauth2.hasScope('words') and hasRole('ROLE_USER') " //+ "and hasAnyRole('"+ ROLE_WORDS_DEMO +"','" + ROLE_WORDS_PRODUCTION +"') " + "and #wordsServiceAuthorizer.accessAllowed()") .and().exceptionHandling().accessDeniedPage("/login.jsp?authorization_error=true").and() // TODO: put CSRF protection back into this endpoint .csrf().requireCsrfProtectionMatcher(new AntPathRequestMatcher("/oauth/authorize")).disable() .logout().logoutSuccessUrl("/index.jsp").logoutUrl("/logout.do").and().formLogin() .usernameParameter("j_username").passwordParameter("j_password") .failureUrl("/login.jsp?authentication_error=true").loginPage("/login.jsp") .loginProcessingUrl("/j_spring_security_check"); }
From source file:org.ng200.openolympus.WebSecurityConfig.java
@Override protected void configure(final HttpSecurity http) throws Exception { http.addFilterBefore(this.characterEncodingFilter(), ChannelProcessingFilter.class).csrf().disable() .headers().xssProtection().and().formLogin().loginPage("/login").failureUrl("/login-failure") .loginProcessingUrl("/login").usernameParameter("username").passwordParameter("password") .permitAll().and().logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout")) .logoutSuccessUrl("/").permitAll().and().rememberMe().rememberMeServices(this.rememberMeServices()) .tokenRepository(this.persistentTokenRepository).key(this.persistentTokenKey).and() .authorizeRequests().antMatchers(WebSecurityConfig.permittedAny).permitAll().and() .authorizeRequests().antMatchers(HttpMethod.POST, WebSecurityConfig.authorisedPost).authenticated() .and().authorizeRequests().antMatchers(HttpMethod.GET, WebSecurityConfig.authorisedGet) .authenticated().and().authorizeRequests() .antMatchers(HttpMethod.GET, WebSecurityConfig.permittedGet).permitAll().and().authorizeRequests() .antMatchers(WebSecurityConfig.administrativeAny).hasAuthority(Role.SUPERUSER).and().httpBasic(); }
From source file:org.lightadmin.core.config.context.LightAdminSecurityConfiguration.java
@Bean @Autowired//from w ww . j a v a2s . co m public FilterChainProxy springSecurityFilterChain(Filter filterSecurityInterceptor, Filter authenticationFilter, Filter rememberMeAuthenticationFilter, Filter logoutFilter, Filter exceptionTranslationFilter, Filter securityContextPersistenceFilter) { List<SecurityFilterChain> filterChains = newArrayList(); for (String pattern : PUBLIC_RESOURCES) { filterChains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher(applicationUrl(pattern)))); } filterChains.add(new DefaultSecurityFilterChain(AnyRequestMatcher.INSTANCE, securityContextPersistenceFilter, exceptionTranslationFilter, logoutFilter, authenticationFilter, rememberMeAuthenticationFilter, filterSecurityInterceptor)); return new FilterChainProxy(filterChains); }
From source file:io.pivotal.cla.config.SecurityConfig.java
private AuthenticationEntryPoint entryPoint() { LinkedHashMap<RequestMatcher, AuthenticationEntryPoint> entryPoints = new LinkedHashMap<>(); entryPoints.put(new AntPathRequestMatcher("/github/hooks/**"), new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED)); entryPoints.put(new AntPathRequestMatcher("/admin/**"), new GitHubAuthenticationEntryPoint( oauthConfig.getMain(), "user:email,repo:status,admin:repo_hook,admin:org_hook,read:org")); BasicAuthenticationEntryPoint basicEntryPoint = new BasicAuthenticationEntryPoint(); basicEntryPoint.setRealmName("Pivotal CLA"); entryPoints.put(new AntPathRequestMatcher("/manage/**"), basicEntryPoint); DelegatingAuthenticationEntryPoint entryPoint = new DelegatingAuthenticationEntryPoint(entryPoints); entryPoint.setDefaultEntryPoint(new GitHubAuthenticationEntryPoint(oauthConfig.getMain(), "user:email")); return entryPoint; }
From source file:com.traffitruck.WebSecurityConfig.java
@Override protected void configure(HttpSecurity http) throws Exception { // handle content encoding CharacterEncodingFilter filter = new CharacterEncodingFilter(); filter.setEncoding("UTF-8"); filter.setForceEncoding(true);//from w w w . ja v a 2 s .c om http.addFilterBefore(filter, CsrfFilter.class); http.authorizeRequests() .antMatchers("/css/**", "/js/**", "/images/**", "/registerUser", "/verifyPhone", "/resendVerificationCode", "/registrationConfirmation", "/forgotPassword", "/resetPassword") .permitAll() .antMatchers("/newload", "/myLoads", "/deleteLoad", "/load_details/**", "/editLoad/**", "/updateload") .hasAuthority(Role.LOAD_OWNER.name()) .antMatchers("/truckerMenu", "/findTrucksForLoad", "/addAvailability", "/myTrucks", "/newTruck", "/load_details_for_trucker/**", "/load_for_truck_by_radius", "/myAlerts", "/newAlert") .hasAuthority(Role.TRUCK_OWNER.name()) .antMatchers("/loads", "/trucks", "/truckApproval", "/nonApprovedTrucks", "/approval/licenseimage/**", "/truckApproval", "/load_details_json/**", "/deleteLoadAdmin", "/users", "/alerts", "/allow_load_details/**") .hasAuthority(Role.ADMIN.name()).anyRequest().authenticated(); http.formLogin().loginPage("/login").successHandler(successHandler()).permitAll().and().logout().permitAll() .deleteCookies("remember-me").logoutRequestMatcher(new AntPathRequestMatcher("/logout")) .logoutSuccessUrl("/login?logout"); http.rememberMe().tokenRepository(repository).userDetailsService(userDetails); http.sessionManagement().maximumSessions(9999).expiredUrl("/login?logout").maxSessionsPreventsLogin(false) .and().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED).invalidSessionUrl("/login"); }
From source file:fi.helsinki.opintoni.config.SAMLSecurityConfiguration.java
@Bean public FilterChainProxy samlFilter() throws Exception { List<SecurityFilterChain> chains = new ArrayList<>(); chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/login/**"), samlEntryPoint())); chains.add(/*from w ww . j ava2 s . co m*/ new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/logout/**"), samlLogoutFilter())); chains.add(new DefaultSecurityFilterChain(new AntPathRequestMatcher("/saml/SSO/**"), samlWebSSOProcessingFilter())); return new FilterChainProxy(chains); }
From source file:de.thm.arsnova.config.SecurityConfig.java
@Bean public LogoutFilter casLogoutFilter() { LogoutFilter filter = new LogoutFilter(casLogoutSuccessHandler(), logoutHandler()); filter.setLogoutRequestMatcher(new AntPathRequestMatcher("/j_spring_cas_security_logout")); return filter; }