Improved the security configuration for all existing endpoints

nastiausenko · Apr 18, 2024 · 9c016b4 · 9c016b4
1 parent e0368c1
commit 9c016b4
Showing 1 changed file with 6 additions and 3 deletions.
diff --git a/src/main/java/com/linkurlshorter/urlshortener/security/SecurityConfig.java b/src/main/java/com/linkurlshorter/urlshortener/security/SecurityConfig.java
@@ -4,6 +4,7 @@
 import lombok.RequiredArgsConstructor;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpMethod;
 import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -52,9 +53,11 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
         return http
                 .csrf(AbstractHttpConfigurer::disable)
                 .authorizeHttpRequests(auth -> auth
-                        .requestMatchers("/api/V1/auth/**").permitAll()
-                        .requestMatchers("/api/V1/user/**").authenticated()
-                        .anyRequest().permitAll()
+                        .requestMatchers(HttpMethod.POST, "/api/V1/auth/**").permitAll()
+                        .requestMatchers(HttpMethod.POST, "/api/V1/user/**").authenticated()
+                        .requestMatchers(HttpMethod.GET, "/*").permitAll()
+                        .requestMatchers("/api/V1/link/**").authenticated()
+                        .anyRequest().denyAll()
                 )
                 .userDetailsService(customUserDetailsService)
                 .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))