update :: 권한 제한

team-xquare · Feb 28, 2024 · 387652c · 387652c
1 parent bec7847
commit 387652c
Showing 1 changed file with 3 additions and 5 deletions.
diff --git a/...1oauthauthorizationservice/infrastructure/configuration/security/SecurityConfiguration.kt b/...1oauthauthorizationservice/infrastructure/configuration/security/SecurityConfiguration.kt
@@ -1,7 +1,6 @@
 package com.example.v1oauthauthorizationservice.infrastructure.configuration.security
 
 import com.example.v1oauthauthorizationservice.infrastructure.configuration.AuthenticationFilter
-import com.example.v1oauthauthorizationservice.infrastructure.user.security.AuthDetailsService
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
 import org.springframework.core.Ordered
@@ -18,8 +17,7 @@ import org.springframework.security.web.access.intercept.AuthorizationFilter
 @EnableWebSecurity(debug = true)
 @Configuration
 class SecurityConfiguration(
-    private val authenticationFilter: AuthenticationFilter,
-        private val authDetailsService: AuthDetailsService
+    private val authenticationFilter: AuthenticationFilter
 ) {
 
     @Bean
@@ -51,10 +49,10 @@ class SecurityConfiguration(
                     .requestMatchers(HttpMethod.POST, "/oauth2/client").authenticated()
                     .requestMatchers(HttpMethod.PATCH, "/oauth2/client/{client-id}").authenticated()
                     .requestMatchers(HttpMethod.GET, "/oauth2/client/{client-id}/secret").authenticated()
-                    .requestMatchers(HttpMethod.POST, "/oauth2/token").authenticated()
+                    .requestMatchers(HttpMethod.POST, "/oauth2/token").permitAll()
                     .requestMatchers(HttpMethod.GET, "/jwk").permitAll()
                     .requestMatchers(HttpMethod.GET, "/oauth2/authorize").authenticated()
-                    .requestMatchers(HttpMethod.GET, "/oauth2/userinfo").authenticated()
+                    .requestMatchers(HttpMethod.GET, "/oauth2/userinfo").permitAll()
                     .anyRequest().authenticated()
             }