avatic/lcc_tool
avatic/lcc_tool
1
0
Fork 0
Code Issues 31 Pull requests 5 Projects Releases Packages Wiki Activity Actions

Added csrf protection matcher to exclude bearer token calls from csfr

Browse source
This commit is contained in:
Jan 2025-10-30 17:04:33 +01:00
parent 98e69164ed
commit 9bf148a09f
1 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
src/main/java/de/avatic/lcc/config/SecurityConfig.java
View file

@ -91,9 +91,18 @@ public class SecurityConfig {
) )
.csrf(csrf -> csrf .csrf(csrf -> csrf
.ignoringRequestMatchers("/oauth2/token") // CSRF für OAuth deaktivieren .ignoringRequestMatchers("/oauth2/token") // CSRF für OAuth deaktivieren
.ignoringRequestMatchers("/login/oauth2/code/**")
.requireCsrfProtectionMatcher(request -> {
String authHeader = request.getHeader("Authorization");
if (authHeader != null && authHeader.startsWith("Bearer ")) {
return false;
}
return true;
})
.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()) .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
.csrfTokenRequestHandler(new LccCsrfTokenRequestHandler()) .csrfTokenRequestHandler(new LccCsrfTokenRequestHandler())
.ignoringRequestMatchers("/login/oauth2/code/**")
) )
.addFilterAfter(new CsrfCookieFilter(), BasicAuthenticationFilter.class) .addFilterAfter(new CsrfCookieFilter(), BasicAuthenticationFilter.class)
.addFilterBefore( .addFilterBefore(