better role-based access control to the differents routes

mariorey · Feb 5, 2020 · 3649974 · 3649974
1 parent b7e77b8
commit 3649974
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/src/main/java/org/springframework/samples/petclinic/configuration/SecurityConfiguration.java b/src/main/java/org/springframework/samples/petclinic/configuration/SecurityConfiguration.java
@@ -34,8 +34,10 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 	protected void configure(HttpSecurity http) throws Exception {
 		http.authorizeRequests()
 				.antMatchers("/resources/**","/webjars/**","/h2-console/**").permitAll()
-				.antMatchers(HttpMethod.GET, "/","/oups").permitAll()
-				.antMatchers("/owners/**","/vets/**").hasAuthority("admin")
+				.antMatchers(HttpMethod.GET, "/","/oups","/register").permitAll()
+//				.antMatchers("/owners/**","/vets/**").hasAuthority("admin")
+				.antMatchers("/owners/**").hasAnyAuthority("owner","admin")
+				.antMatchers("/vets/**").authenticated()
 				.anyRequest().denyAll()
 				.and()
 				 	.formLogin()