cors = List.of();
+
+ /**
+ * OpenID Providers configuration. A minimum of one issuer is required. Properties defined here
+ * are a replacement for spring.security.oauth2.resourceserver.jwt.* (which will be ignored).
+ * Authorities mapping defined here is used by both client and resource server filter-chains.
+ *
+ * @author Jerome Wacongne ch4mp@c4-soft.com
+ */
+ @Data
+ static public class OpenidProviderProperties {
/**
- * OpenID Providers configuration: JWK set URI, issuer URI, audience, and authorities mapping configuration for each issuer. A minimum of one issuer is
- * required. Properties defined here are a replacement for spring.security.oauth2.resourceserver.jwt.* (which will be ignored). Authorities mapping
- * defined there is used by both client and resource server filter-chains.
+ *
+ * Must be exactly the same as in access tokens (even trailing slash, if any, is important). In
+ * case of doubt, open one of your access tokens with a tool like
+ * https://jwt.io.
+ *
*/
- private List ops = List.of();
+ private URI iss;
/**
- * Auto-configuration for an OAuth2 client (secured with session, not access token) Security(Web)FilterChain with @Order(Ordered.LOWEST_PRECEDENCE - 1).
- * Typical use-cases are spring-cloud-gateway used as BFF and applications with Thymeleaf or another server-side rendering framework. Default configuration
- * includes: enabled sessions, CSRF protection, "oauth2Login", "logout". securityMatchers must be set for this filter-chain @Bean and its dependencies
- * to be defined. Properties defined here are a complement for spring.security.oauth2.client.* (which are required when enabling spring-addons client
- * filter-chain).
+ * Can be omitted if OpenID configuration can be retrieved from
+ * ${iss}/.well-known/openid-configuration
*/
- @NestedConfigurationProperty
- private SpringAddonsOidcClientProperties client = new SpringAddonsOidcClientProperties();
+ private URI jwkSetUri;
/**
- * Auto-configuration for an OAuth2 resource server Security(Web)FilterChain with @Order(LOWEST_PRECEDENCE). Typical use case is a REST API secured with
- * access tokens. Default configuration is as follow: no securityMatcher to process all the requests that were not intercepted by higher @Order
- * Security(Web)FilterChains, no session, disabled CSRF protection, and 401 to unauthorized requests.
+ * Can be omitted. Will insert an audience validator if not null or empty
*/
- @NestedConfigurationProperty
- private SpringAddonsOidcResourceServerProperties resourceserver = new SpringAddonsOidcResourceServerProperties();
+ private String aud;
- private List cors = List.of();
+ /**
+ * Authorities mapping configuration, per claim
+ */
+ private List authorities = List.of();
/**
- * OpenID Providers configuration. A minimum of one issuer is required. Properties defined here are a replacement for
- * spring.security.oauth2.resourceserver.jwt.* (which will be ignored). Authorities mapping defined here is used by both client and resource server
- * filter-chains.
- *
- * @author Jerome Wacongne ch4mp@c4-soft.com
+ * JSON path for the claim to use as "name" source
*/
+ private String usernameClaim = StandardClaimNames.SUB;
+
@Data
- @ConfigurationProperties
- static public class OpenidProviderProperties {
- /**
- *
- * Must be exactly the same as in access tokens (even trailing slash, if any, is important). In case of doubt, open one of your access tokens with a
- * tool like https://jwt.io.
- *
- */
- private URI iss;
-
- /**
- * Can be omitted if OpenID configuration can be retrieved from ${iss}/.well-known/openid-configuration
- */
- private URI jwkSetUri;
-
- /**
- * Can be omitted. Will insert an audience validator if not null or empty
- */
- private String aud;
-
- /**
- * Authorities mapping configuration, per claim
- */
- private List authorities = List.of();
-
- /**
- * JSON path for the claim to use as "name" source
- */
- private String usernameClaim = StandardClaimNames.SUB;
-
- @Data
- @ConfigurationProperties
- public static class SimpleAuthoritiesMappingProperties {
- /**
- * JSON path of the claim(s) to map with this properties
- */
- private String path = "$.realm_access.roles";
-
- /**
- * What to prefix authorities with (for instance "ROLE_" or "SCOPE_")
- */
- private String prefix = "";
-
- /**
- * Whether to transform authorities to uppercase, lowercase, or to leave it unchanged
- */
- private Case caze = Case.UNCHANGED;
-
- public static enum Case {
- UNCHANGED,
- UPPER,
- LOWER
- }
-
- }
+ public static class SimpleAuthoritiesMappingProperties {
+ /**
+ * JSON path of the claim(s) to map with this properties
+ */
+ private String path = "$.realm_access.roles";
+
+ /**
+ * What to prefix authorities with (for instance "ROLE_" or "SCOPE_")
+ */
+ private String prefix = "";
+
+ /**
+ * Whether to transform authorities to uppercase, lowercase, or to leave it unchanged
+ */
+ private Case caze = Case.UNCHANGED;
+
+ public static enum Case {
+ UNCHANGED, UPPER, LOWER
+ }
+
}
+ }
}
diff --git a/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/SpringAddonsOidcResourceServerProperties.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/SpringAddonsOidcResourceServerProperties.java
index 6827b318b..610abb54d 100644
--- a/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/SpringAddonsOidcResourceServerProperties.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/SpringAddonsOidcResourceServerProperties.java
@@ -1,48 +1,47 @@
package com.c4_soft.springaddons.security.oidc.starter.properties;
import java.util.List;
-
-import org.springframework.boot.context.properties.ConfigurationProperties;
-
import lombok.Data;
/**
- * Auto-configuration for an OAuth2 resource server Security(Web)FilterChain with @Order(LOWEST_PRECEDENCE). Typical use case is a REST API secured with
- * access tokens. Default configuration is as follow: no securityMatcher to process all the requests that were not intercepted by higher @Order
- * Security(Web)FilterChains, no session, disabled CSRF protection, and 401 to unauthorized requests.
+ * Auto-configuration for an OAuth2 resource server Security(Web)FilterChain with
+ * @Order(LOWEST_PRECEDENCE). Typical use case is a REST API secured with access tokens. Default
+ * configuration is as follow: no securityMatcher to process all the requests that were not
+ * intercepted by higher @Order Security(Web)FilterChains, no session, disabled CSRF protection,
+ * and 401 to unauthorized requests.
*
* @author Jerome Wacongne ch4mp@c4-soft.com
*/
@Data
-@ConfigurationProperties
public class SpringAddonsOidcResourceServerProperties {
- /**
- * Resource server SecurityFilterChain bean and all its dependencies are instantiated only if true.
- */
- private boolean enabled = true;
-
- /**
- * Path matchers for the routes accessible to anonymous requests
- */
- private List permitAll = List.of();
-
- /**
- * Whether to disable sessions. It should remain true.
- */
- private boolean statlessSessions = true;
-
- /**
- * CSRF protection configuration for the auto-configured client filter-chain
- */
- private Csrf csrf = Csrf.DISABLE;
-
- /**
- * Fine grained CORS configuration
- *
- * @deprecated use com.c4-soft.springaddons.oidc.cors instead
- */
- @Deprecated(forRemoval = true)
- private List cors = List.of();
+ /**
+ * Resource server SecurityFilterChain bean and all its dependencies are instantiated only if
+ * true.
+ */
+ private boolean enabled = true;
+
+ /**
+ * Path matchers for the routes accessible to anonymous requests
+ */
+ private List permitAll = List.of();
+
+ /**
+ * Whether to disable sessions. It should remain true.
+ */
+ private boolean statlessSessions = true;
+
+ /**
+ * CSRF protection configuration for the auto-configured client filter-chain
+ */
+ private Csrf csrf = Csrf.DISABLE;
+
+ /**
+ * Fine grained CORS configuration
+ *
+ * @deprecated use com.c4-soft.springaddons.oidc.cors instead
+ */
+ @Deprecated(forRemoval = true)
+ private List cors = List.of();
}
diff --git a/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/HasTokenEdpointParametersPropertiesCondition.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/HasTokenEdpointParametersPropertiesCondition.java
index 511d8e0ab..322f4c5b4 100644
--- a/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/HasTokenEdpointParametersPropertiesCondition.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/HasTokenEdpointParametersPropertiesCondition.java
@@ -2,7 +2,7 @@
public class HasTokenEdpointParametersPropertiesCondition extends HasPropertyPrefixCondition {
- public HasTokenEdpointParametersPropertiesCondition() {
- super("com.c4-soft.springaddons.oidc.client.token-request-params");
- }
+ public HasTokenEdpointParametersPropertiesCondition() {
+ super("com.c4-soft.springaddons.oidc.client.token-request-params");
+ }
}
diff --git a/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/bean/DefaultAuthenticationEntryPointCondition.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/bean/DefaultAuthenticationEntryPointCondition.java
new file mode 100644
index 000000000..7df6c7b01
--- /dev/null
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/bean/DefaultAuthenticationEntryPointCondition.java
@@ -0,0 +1,21 @@
+package com.c4_soft.springaddons.security.oidc.starter.properties.condition.bean;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
+import org.springframework.boot.autoconfigure.condition.NoneNestedConditions;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.security.web.server.ServerAuthenticationEntryPoint;
+
+public class DefaultAuthenticationEntryPointCondition extends NoneNestedConditions {
+
+ public DefaultAuthenticationEntryPointCondition() {
+ super(ConfigurationPhase.REGISTER_BEAN);
+ }
+
+ @ConditionalOnBean(AuthenticationEntryPoint.class)
+ static class AuthenticationEntryPointCondition {
+ }
+
+ @ConditionalOnBean(ServerAuthenticationEntryPoint.class)
+ static class ServerAuthenticationEntryPointCondition {
+ }
+}
diff --git a/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/bean/DefaultAuthenticationSuccessHandlerCondition.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/bean/DefaultAuthenticationSuccessHandlerCondition.java
index 34c04f0a0..a4fe0c30d 100644
--- a/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/bean/DefaultAuthenticationSuccessHandlerCondition.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/bean/DefaultAuthenticationSuccessHandlerCondition.java
@@ -3,6 +3,7 @@
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
import org.springframework.boot.autoconfigure.condition.NoneNestedConditions;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler;
public class DefaultAuthenticationSuccessHandlerCondition extends NoneNestedConditions {
@@ -14,7 +15,7 @@ public DefaultAuthenticationSuccessHandlerCondition() {
static class AuthenticationSuccessHandlerProvidedCondition {
}
- @ConditionalOnBean(AuthenticationSuccessHandler.class)
+ @ConditionalOnBean(ServerAuthenticationSuccessHandler.class)
static class ServerAuthenticationSuccessHandlerProvidedCondition {
}
}
diff --git a/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/bean/DefaultOidcBackChannelLogoutHandlerCondition.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/bean/DefaultOidcBackChannelLogoutHandlerCondition.java
new file mode 100644
index 000000000..d096bae10
--- /dev/null
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/bean/DefaultOidcBackChannelLogoutHandlerCondition.java
@@ -0,0 +1,27 @@
+package com.c4_soft.springaddons.security.oidc.starter.properties.condition.bean;
+
+import org.springframework.boot.autoconfigure.condition.AllNestedConditions;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.security.config.annotation.web.configurers.oauth2.client.OidcBackChannelLogoutHandler;
+import org.springframework.security.config.web.server.OidcBackChannelServerLogoutHandler;
+
+public class DefaultOidcBackChannelLogoutHandlerCondition extends AllNestedConditions {
+
+ public DefaultOidcBackChannelLogoutHandlerCondition() {
+ super(ConfigurationPhase.REGISTER_BEAN);
+ }
+
+ @ConditionalOnProperty(name = "com.c4-soft.springaddons.oidc.client.back-channel-logout.enabled")
+ static class BackChannelLogoutEnabledCondition {
+ }
+
+ @ConditionalOnMissingBean(OidcBackChannelLogoutHandler.class)
+ static class NoOidcBackChannelLogoutHandlerCondition {
+ }
+
+ @ConditionalOnMissingBean(OidcBackChannelServerLogoutHandler.class)
+ static class NoOidcBackChannelServerLogoutHandlerCondition {
+ }
+
+}
diff --git a/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/bean/DefaultOidcSessionRegistryCondition.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/bean/DefaultOidcSessionRegistryCondition.java
new file mode 100644
index 000000000..538d26f74
--- /dev/null
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/properties/condition/bean/DefaultOidcSessionRegistryCondition.java
@@ -0,0 +1,24 @@
+package com.c4_soft.springaddons.security.oidc.starter.properties.condition.bean;
+
+import org.springframework.boot.autoconfigure.condition.AllNestedConditions;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.security.oauth2.client.oidc.server.session.ReactiveOidcSessionRegistry;
+import org.springframework.security.oauth2.client.oidc.session.OidcSessionRegistry;
+
+public class DefaultOidcSessionRegistryCondition extends AllNestedConditions {
+
+ public DefaultOidcSessionRegistryCondition() {
+ super(ConfigurationPhase.REGISTER_BEAN);
+ }
+
+ @ConditionalOnProperty(name = "com.c4-soft.springaddons.oidc.client.back-channel-logout.enabled")
+ static class BackChannelLogoutEnabledCondition {}
+
+ @ConditionalOnMissingBean(OidcSessionRegistry.class)
+ static class NoOidcSessionRegistryCondition {}
+
+ @ConditionalOnMissingBean(ReactiveOidcSessionRegistry.class)
+ static class NoReactiveOidcSessionRegistryCondition {}
+
+}
diff --git a/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/ReactiveConfigurationSupport.java b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/ReactiveConfigurationSupport.java
index 54dd95101..6d358f39b 100644
--- a/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/ReactiveConfigurationSupport.java
+++ b/spring-addons-starter-oidc/src/main/java/com/c4_soft/springaddons/security/oidc/starter/reactive/ReactiveConfigurationSupport.java
@@ -1,16 +1,18 @@
package com.c4_soft.springaddons.security.oidc.starter.reactive;
import static org.springframework.security.config.Customizer.withDefaults;
-
+import java.net.URI;
+import java.nio.charset.Charset;
import java.util.ArrayList;
import java.util.List;
-import java.util.Optional;
-
+import java.util.stream.Collectors;
import org.springframework.boot.autoconfigure.web.ServerProperties;
+import org.springframework.core.io.buffer.DataBufferUtils;
+import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpMethod;
+import org.springframework.http.HttpStatus;
import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.web.server.ServerAuthenticationEntryPoint;
-import org.springframework.security.web.server.authorization.ServerAccessDeniedHandler;
+import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.server.context.NoOpServerSecurityContextRepository;
import org.springframework.security.web.server.csrf.CookieServerCsrfTokenRepository;
import org.springframework.security.web.server.csrf.CsrfToken;
@@ -20,176 +22,193 @@
import org.springframework.web.cors.reactive.CorsWebFilter;
import org.springframework.web.cors.reactive.UrlBasedCorsConfigurationSource;
import org.springframework.web.server.ServerWebExchange;
-
import com.c4_soft.springaddons.security.oidc.starter.properties.CorsProperties;
import com.c4_soft.springaddons.security.oidc.starter.properties.Csrf;
import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcProperties;
+import com.c4_soft.springaddons.security.oidc.starter.properties.SpringAddonsOidcProperties.OpenidProviderProperties;
import com.c4_soft.springaddons.security.oidc.starter.reactive.client.ClientAuthorizeExchangeSpecPostProcessor;
import com.c4_soft.springaddons.security.oidc.starter.reactive.client.ClientReactiveHttpSecurityPostProcessor;
import com.c4_soft.springaddons.security.oidc.starter.reactive.resourceserver.ResourceServerAuthorizeExchangeSpecPostProcessor;
import com.c4_soft.springaddons.security.oidc.starter.reactive.resourceserver.ResourceServerReactiveHttpSecurityPostProcessor;
-
import reactor.core.publisher.Mono;
public class ReactiveConfigurationSupport {
- public static ServerHttpSecurity configureResourceServer(
- ServerHttpSecurity http,
- ServerProperties serverProperties,
- SpringAddonsOidcProperties addonsProperties,
- ServerAuthenticationEntryPoint authenticationEntryPoint,
- Optional accessDeniedHandler,
- ResourceServerAuthorizeExchangeSpecPostProcessor authorizePostProcessor,
- ResourceServerReactiveHttpSecurityPostProcessor httpPostProcessor) {
-
- ReactiveConfigurationSupport
- .configureState(http, addonsProperties.getResourceserver().isStatlessSessions(), addonsProperties.getResourceserver().getCsrf());
-
- // FIXME: use only the new CORS properties at next major release
- final var corsProps = new ArrayList<>(addonsProperties.getCors());
- final var deprecatedClientCorsProps = addonsProperties.getClient().getCors();
- final var deprecatedResourceServerCorsProps = addonsProperties.getResourceserver().getCors();
- corsProps.addAll(deprecatedClientCorsProps);
- corsProps.addAll(deprecatedResourceServerCorsProps);
- ReactiveConfigurationSupport.configureAccess(http, addonsProperties.getResourceserver().getPermitAll(), corsProps);
-
- http.exceptionHandling(handling -> {
- handling.authenticationEntryPoint(authenticationEntryPoint);
- accessDeniedHandler.ifPresent(handling::accessDeniedHandler);
- });
-
- if (serverProperties.getSsl() != null && serverProperties.getSsl().isEnabled()) {
- http.redirectToHttps(withDefaults());
- }
-
- http.authorizeExchange(registry -> authorizePostProcessor.authorizeHttpRequests(registry));
- httpPostProcessor.process(http);
-
- return http;
+ public static ServerHttpSecurity configureResourceServer(ServerHttpSecurity http,
+ ServerProperties serverProperties, SpringAddonsOidcProperties addonsProperties,
+ ResourceServerAuthorizeExchangeSpecPostProcessor authorizePostProcessor,
+ ResourceServerReactiveHttpSecurityPostProcessor httpPostProcessor) {
+
+ http.exceptionHandling(exceptions -> {
+ final var issuers = addonsProperties.getOps().stream().map(OpenidProviderProperties::getIss)
+ .filter(iss -> iss != null).map(URI::toString)
+ .collect(Collectors.joining(",", "\"", "\""));
+ exceptions
+ .authenticationEntryPoint((ServerWebExchange exchange, AuthenticationException ex) -> {
+ var response = exchange.getResponse();
+ response.setStatusCode(HttpStatus.UNAUTHORIZED);
+ response.getHeaders().set(HttpHeaders.WWW_AUTHENTICATE,
+ "OAuth realm=%s".formatted(issuers));
+ var dataBufferFactory = response.bufferFactory();
+ var buffer = dataBufferFactory.wrap(ex.getMessage().getBytes(Charset.defaultCharset()));
+ return response.writeWith(Mono.just(buffer))
+ .doOnError(error -> DataBufferUtils.release(buffer));
+ });
+ });
+
+ ReactiveConfigurationSupport.configureState(http,
+ addonsProperties.getResourceserver().isStatlessSessions(),
+ addonsProperties.getResourceserver().getCsrf());
+
+ // FIXME: use only the new CORS properties at next major release
+ final var corsProps = new ArrayList<>(addonsProperties.getCors());
+ final var deprecatedClientCorsProps = addonsProperties.getClient().getCors();
+ final var deprecatedResourceServerCorsProps = addonsProperties.getResourceserver().getCors();
+ corsProps.addAll(deprecatedClientCorsProps);
+ corsProps.addAll(deprecatedResourceServerCorsProps);
+ ReactiveConfigurationSupport.configureAccess(http,
+ addonsProperties.getResourceserver().getPermitAll(), corsProps);
+
+ if (serverProperties.getSsl() != null && serverProperties.getSsl().isEnabled()) {
+ http.redirectToHttps(withDefaults());
}
- public static ServerHttpSecurity configureClient(
- ServerHttpSecurity http,
- ServerProperties serverProperties,
- SpringAddonsOidcProperties addonsProperties,
- ClientAuthorizeExchangeSpecPostProcessor authorizePostProcessor,
- ClientReactiveHttpSecurityPostProcessor httpPostProcessor) {
+ http.authorizeExchange(registry -> authorizePostProcessor.authorizeHttpRequests(registry));
+ httpPostProcessor.process(http);
- ReactiveConfigurationSupport.configureState(http, false, addonsProperties.getClient().getCsrf());
+ return http;
+ }
- // FIXME: use only the new CORS properties at next major release
- final var corsProps = new ArrayList<>(addonsProperties.getCors());
- final var deprecatedClientCorsProps = addonsProperties.getClient().getCors();
- final var deprecatedResourceServerCorsProps = addonsProperties.getResourceserver().getCors();
- corsProps.addAll(deprecatedClientCorsProps);
- corsProps.addAll(deprecatedResourceServerCorsProps);
- ReactiveConfigurationSupport.configureAccess(http, addonsProperties.getClient().getPermitAll(), corsProps);
+ public static ServerHttpSecurity configureClient(ServerHttpSecurity http,
+ ServerProperties serverProperties, SpringAddonsOidcProperties addonsProperties,
+ ClientAuthorizeExchangeSpecPostProcessor authorizePostProcessor,
+ ClientReactiveHttpSecurityPostProcessor httpPostProcessor) {
- if (serverProperties.getSsl() != null && serverProperties.getSsl().isEnabled()) {
- http.redirectToHttps(withDefaults());
- }
+ ReactiveConfigurationSupport.configureState(http, false,
+ addonsProperties.getClient().getCsrf());
- http.authorizeExchange(registry -> authorizePostProcessor.authorizeHttpRequests(registry));
- httpPostProcessor.process(http);
+ // FIXME: use only the new CORS properties at next major release
+ final var corsProps = new ArrayList<>(addonsProperties.getCors());
+ final var deprecatedClientCorsProps = addonsProperties.getClient().getCors();
+ final var deprecatedResourceServerCorsProps = addonsProperties.getResourceserver().getCors();
+ corsProps.addAll(deprecatedClientCorsProps);
+ corsProps.addAll(deprecatedResourceServerCorsProps);
+ ReactiveConfigurationSupport.configureAccess(http, addonsProperties.getClient().getPermitAll(),
+ corsProps);
- return http;
+ if (serverProperties.getSsl() != null && serverProperties.getSsl().isEnabled()) {
+ http.redirectToHttps(withDefaults());
}
- public static ServerHttpSecurity configureAccess(ServerHttpSecurity http, List permitAll, List corsProperties) {
- final var permittedCorsOptions = corsProperties
- .stream()
- .filter(cors -> (cors.getAllowedMethods().contains("*") || cors.getAllowedMethods().contains("OPTIONS")) && !cors.isDisableAnonymousOptions())
- .map(CorsProperties::getPath)
- .toList();
+ http.authorizeExchange(registry -> authorizePostProcessor.authorizeHttpRequests(registry));
+ httpPostProcessor.process(http);
+
+ return http;
+ }
- if (permitAll.size() > 0 || permittedCorsOptions.size() > 0) {
- http.anonymous(withDefaults());
- }
+ public static ServerHttpSecurity configureAccess(ServerHttpSecurity http, List permitAll,
+ List corsProperties) {
+ final var permittedCorsOptions = corsProperties.stream()
+ .filter(cors -> (cors.getAllowedMethods().contains("*")
+ || cors.getAllowedMethods().contains("OPTIONS")) && !cors.isDisableAnonymousOptions())
+ .map(CorsProperties::getPath).toList();
- if (permitAll.size() > 0) {
- http.authorizeExchange(authorizeExchange -> authorizeExchange.pathMatchers(permitAll.toArray(new String[] {})).permitAll());
- }
+ if (permitAll.size() > 0 || permittedCorsOptions.size() > 0) {
+ http.anonymous(withDefaults());
+ }
- if (permittedCorsOptions.size() > 0) {
- http
- .authorizeExchange(
- authorizeExchange -> authorizeExchange.pathMatchers(HttpMethod.OPTIONS, permittedCorsOptions.toArray(new String[] {})).permitAll());
- }
+ if (permitAll.size() > 0) {
+ http.authorizeExchange(authorizeExchange -> authorizeExchange
+ .pathMatchers(permitAll.toArray(new String[] {})).permitAll());
+ }
- return http;
+ if (permittedCorsOptions.size() > 0) {
+ http.authorizeExchange(authorizeExchange -> authorizeExchange
+ .pathMatchers(HttpMethod.OPTIONS, permittedCorsOptions.toArray(new String[] {}))
+ .permitAll());
}
- public static CorsWebFilter getCorsFilterBean(List corsProperties) {
- final var source = new UrlBasedCorsConfigurationSource();
- for (final var corsProps : corsProperties) {
- final var configuration = new CorsConfiguration();
- configuration.setAllowCredentials(corsProps.getAllowCredentials());
- configuration.setAllowedHeaders(corsProps.getAllowedHeaders());
- configuration.setAllowedMethods(corsProps.getAllowedMethods());
- configuration.setAllowedOriginPatterns(corsProps.getAllowedOriginPatterns());
- configuration.setExposedHeaders(corsProps.getExposedHeaders());
- configuration.setMaxAge(corsProps.getMaxAge());
- source.registerCorsConfiguration(corsProps.getPath(), configuration);
- }
- return new CorsWebFilter(source);
+ return http;
+ }
+
+ public static CorsWebFilter getCorsFilterBean(List corsProperties) {
+ final var source = new UrlBasedCorsConfigurationSource();
+ for (final var corsProps : corsProperties) {
+ final var configuration = new CorsConfiguration();
+ configuration.setAllowCredentials(corsProps.getAllowCredentials());
+ configuration.setAllowedHeaders(corsProps.getAllowedHeaders());
+ configuration.setAllowedMethods(corsProps.getAllowedMethods());
+ configuration.setAllowedOriginPatterns(corsProps.getAllowedOriginPatterns());
+ configuration.setExposedHeaders(corsProps.getExposedHeaders());
+ configuration.setMaxAge(corsProps.getMaxAge());
+ source.registerCorsConfiguration(corsProps.getPath(), configuration);
+ }
+ return new CorsWebFilter(source);
+ }
+
+ public static ServerHttpSecurity configureState(ServerHttpSecurity http, boolean isStatless,
+ Csrf csrfEnum) {
+
+ if (isStatless) {
+ http.securityContextRepository(NoOpServerSecurityContextRepository.getInstance());
}
- public static ServerHttpSecurity configureState(ServerHttpSecurity http, boolean isStatless, Csrf csrfEnum) {
-
- if (isStatless) {
- http.securityContextRepository(NoOpServerSecurityContextRepository.getInstance());
- }
-
- http.csrf(csrf -> {
- switch (csrfEnum) {
- case DISABLE:
- csrf.disable();
- break;
- case DEFAULT:
- if (isStatless) {
- csrf.disable();
- } else {
- withDefaults();
- }
- break;
- case SESSION:
- withDefaults();
- break;
- case COOKIE_ACCESSIBLE_FROM_JS:
- // adapted from https://docs.spring.io/spring-security/reference/servlet/exploits/csrf.html#csrf-integration-javascript-spa
- csrf.csrfTokenRepository(CookieServerCsrfTokenRepository.withHttpOnlyFalse()).csrfTokenRequestHandler(new SpaCsrfTokenRequestHandler());
- break;
- }
- });
-
- return http;
+ http.csrf(csrf -> {
+ switch (csrfEnum) {
+ case DISABLE:
+ csrf.disable();
+ break;
+ case DEFAULT:
+ if (isStatless) {
+ csrf.disable();
+ } else {
+ withDefaults();
+ }
+ break;
+ case SESSION:
+ withDefaults();
+ break;
+ case COOKIE_ACCESSIBLE_FROM_JS:
+ // adapted from
+ // https://docs.spring.io/spring-security/reference/servlet/exploits/csrf.html#csrf-integration-javascript-spa
+ csrf.csrfTokenRepository(CookieServerCsrfTokenRepository.withHttpOnlyFalse())
+ .csrfTokenRequestHandler(new SpaCsrfTokenRequestHandler());
+ break;
+ }
+ });
+
+ return http;
+ }
+
+ /**
+ * Adapted from
+ * https://docs.spring.io/spring-security/reference/servlet/exploits/csrf.html#csrf-integration-javascript-spa
+ */
+ static final class SpaCsrfTokenRequestHandler extends ServerCsrfTokenRequestAttributeHandler {
+ private final ServerCsrfTokenRequestAttributeHandler delegate =
+ new XorServerCsrfTokenRequestAttributeHandler();
+
+ @Override
+ public void handle(ServerWebExchange exchange, Mono csrfToken) {
+ /*
+ * Always use XorCsrfTokenRequestAttributeHandler to provide BREACH protection of the
+ * CsrfToken when it is rendered in the response body.
+ */
+ this.delegate.handle(exchange, csrfToken);
}
- /**
- * Adapted from https://docs.spring.io/spring-security/reference/servlet/exploits/csrf.html#csrf-integration-javascript-spa
- */
- static final class SpaCsrfTokenRequestHandler extends ServerCsrfTokenRequestAttributeHandler {
- private final ServerCsrfTokenRequestAttributeHandler delegate = new XorServerCsrfTokenRequestAttributeHandler();
-
- @Override
- public void handle(ServerWebExchange exchange, Mono