@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception
{
http
.headers()
.frameOptions()
.disable()
.addHeaderWriter(new StaticHeadersWriter("Content-Security-Policy", "frame-ancestors 'self'"))
.and()
.csrf()
.requireCsrfProtectionMatcher(new AndRequestMatcher(CsrfFilter.DEFAULT_CSRF_MATCHER, new RegexRequestMatcher("^(?!/api/)", null)))
.and()
.authorizeRequests()
.antMatchers("/").fullyAuthenticated()
.antMatchers("/client/**").hasAnyAuthority("CLIENT", "SUPER_ADMIN", "ADMIN")
.antMatchers("/admin/**").hasAnyAuthority("SUPER_ADMIN", "ADMIN")
.antMatchers("/actuator/**").hasAnyAuthority("SUPER_ADMIN", "ADMIN")
.antMatchers("/api/auth/**").permitAll()
.antMatchers("/api/**").hasAnyAuthority("ADMIN", "SUPER_ADMIN", "CLIENT", "API_USER")
.and()
.formLogin()
.loginPage("/user/login")
.successHandler(successHandler())
.failureUrl("/user/login?error=true")
.defaultSuccessUrl("/")
.usernameParameter("username")
.and()
.logout()
.logoutRequestMatcher(new AntPathRequestMatcher("/user/logout"))
.deleteCookies("remember-me")
.logoutSuccessUrl("/user/login")
.and()
.rememberMe()
.userDetailsService(userDetailsService);
return http.build();
}
