Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add configuration for not deployed profile #1345

Merged
merged 2 commits into from
Apr 24, 2023
Merged

Add configuration for not deployed profile #1345

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
187ace3
Enable CSRF
ihrasko Apr 5, 2023
b90a581
Add configuration for not deployed profile
Tobianas Apr 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions .../main/java/io/lighty/core/controller/springboot/config/SecurityConfigurationDeployed.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
/*
* Copyright (c) 2018 PANTHEON.tech s.r.o. All Rights Reserved.
*
* This program and the accompanying materials are made available under the
* terms of the Eclipse Public License v1.0 which accompanies this distribution,
* and is available at https://www.eclipse.org/legal/epl-v10.html
*/
package io.lighty.core.controller.springboot.config;

import io.lighty.core.controller.springboot.services.UserAccessService;
import org.casbin.jcasbin.main.Enforcer;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
import org.springframework.security.web.csrf.CookieCsrfTokenRepository;

@EnableWebSecurity
@Configuration
@Profile("deployed")
public class SecurityConfigurationDeployed {

private final Enforcer enforcer;
private final UserAccessService userAccessService;

@Autowired
public SecurityConfigurationDeployed(Enforcer enforcer, UserAccessService userAccessService) {
this.enforcer = enforcer;
this.userAccessService = userAccessService;
}

@Bean
@Order(1)
protected SecurityFilterChain auth0FilterChain(HttpSecurity httpSecurity) throws Exception {
return httpSecurity
.csrf()
.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
.and()
.addFilterBefore(new JCasBinFilter(enforcer, userAccessService), BasicAuthenticationFilter.class)
.securityMatcher("/services/data/**")
.build();
}
}
14 changes: 7 additions & 7 deletions ...ingboot/config/SecurityConfiguration.java → ...fig/SecurityConfigurationNotDeployed.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,18 @@
/*
* Copyright (c) 2018-2021 PANTHEON.tech s.r.o. All Rights Reserved.
* Copyright (c) 2023 PANTHEON.tech s.r.o. All Rights Reserved.
*
* This program and the accompanying materials are made available under the
* terms of the Eclipse Public License v1.0 which accompanies this distribution,
* and is available at https://www.eclipse.org/legal/epl-v10.html
*/

package io.lighty.core.controller.springboot.config;

import io.lighty.core.controller.springboot.services.UserAccessService;
import org.casbin.jcasbin.main.Enforcer;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
Expand All @@ -21,13 +21,14 @@

@EnableWebSecurity
@Configuration
public class SecurityConfiguration {
@Profile("!deployed") //Not(!) deployed profile
public class SecurityConfigurationNotDeployed {

private final Enforcer enforcer;
private final UserAccessService userAccessService;

@Autowired
public SecurityConfiguration(Enforcer enforcer, UserAccessService userAccessService) {
public SecurityConfigurationNotDeployed(Enforcer enforcer, UserAccessService userAccessService) {
this.enforcer = enforcer;
this.userAccessService = userAccessService;
}
Expand All @@ -36,11 +37,10 @@ public SecurityConfiguration(Enforcer enforcer, UserAccessService userAccessServ
@Order(1)
protected SecurityFilterChain auth0FilterChain(HttpSecurity httpSecurity) throws Exception {
return httpSecurity
.addFilterBefore(new JCasBinFilter(enforcer, userAccessService), BasicAuthenticationFilter.class)
.securityMatcher("/services/data/**")
.csrf()
.disable()
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

0% of developers fix this issue

SPRING_CSRF_PROTECTION_DISABLED: Disabling Spring Security's CSRF protection is unsafe for standard web applications

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage
@sonatype-lift ignore Leave out the above finding from this PR
@sonatype-lift ignoreall Leave out all the existing findings from this PR
@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
Click here to add LiftBot to another repo.

Help us improve LIFT! (Sonatype LiftBot external survey)

Was this a good recommendation for you? Answering this survey will not impact your Lift settings.

[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ignore

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've recorded this as ignored for this pull request.
If you change your mind, just comment @sonatype-lift unignore.

.addFilterBefore(new JCasBinFilter(enforcer, userAccessService), BasicAuthenticationFilter.class)
.securityMatcher("/services/data/**")
.build();
}

}