package com.hascode.tutorial; import com.hascode.tutorial.auth.JwtAuthFilter; import com.hascode.tutorial.auth.JwtAuthenticationEntryPoint; import com.hascode.tutorial.auth.JwtAuthenticationProvider; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Configuration; import org.springframework.http.HttpMethod; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.WebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; @Configuration public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private JwtAuthFilter jwtAuthFilter; @Autowired private JwtAuthenticationProvider jwtAuthenticationProvider; @Autowired private JwtAuthenticationEntryPoint jwtAuthEndPoint; @Override public void configure(AuthenticationManagerBuilder auth) throws Exception { auth.authenticationProvider(jwtAuthenticationProvider); } @Override protected void configure(HttpSecurity http) throws Exception { http.csrf().ignoringAntMatchers("/login"); http.authorizeRequests() .antMatchers("/login") .permitAll() .antMatchers("/oauth/token") .authenticated() .antMatchers("/oauth/authorize") .hasAuthority("ROLE_USER") .and() .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class) .exceptionHandling() .authenticationEntryPoint(jwtAuthEndPoint); } }