Updating few dependencies, cleaning up some security configurations

surajcm · Jul 31, 2023 · 7febb1d · 7febb1d
1 parent f44fdd2
commit 7febb1d
Show file tree

Hide file tree

Showing 5 changed files with 39 additions and 20 deletions.
diff --git a/build.gradle b/build.gradle
@@ -18,12 +18,12 @@ buildscript {
 plugins {
 	id 'java'
 	id 'idea'
-	id 'org.springframework.boot' version '3.1.1'
-	id 'io.spring.dependency-management' version '1.1.0'
+	id 'org.springframework.boot' version '3.1.2'
+	id 'io.spring.dependency-management' version '1.1.2'
 	id 'net.ltgt.errorprone' version '3.1.0'
 	id 'com.github.spotbugs' version '5.0.14' apply false
 	id 'de.aaschmid.cpd' version '3.3'
-	id "org.sonarqube" version "4.2.1.3168"
+	id "org.sonarqube" version "4.3.0.3225"
 }
 
 group = 'com.quiz.darkhold'

diff --git a/config/checkstyle/suppressions.xml b/config/checkstyle/suppressions.xml
@@ -6,16 +6,17 @@
 
 <!--
 NOTES:
-Refer to Checkstyle Filters page given below to learn more abour suppression filter.
+Refer to Checkstyle Filters page given below to learn more about suppression filter.
 http://checkstyle.sourceforge.net/config_filters.html#SuppressionFilter
 WHAT AND WHY CHECKS SUPPRESSED
 ==============================
- - Indentation: Google style guide uses 2 spaces for identation, we use 4
+ - Indentation: Google style guide uses 2 spaces for indentation, we use 4
  - LineLength: Google style guice states to limit lines to 100, we prefer 120
  - JavadocParagraph: IDEs cannot put <p> immediately before the first word of the new paragraph
 -->
 
 <suppressions>
     <suppress files="ChallengeService.java" checks="MethodLength"/>
     <suppress files="SecurityConfig.java" checks="MethodLength"/>
+    <suppress files="SecurityConfig.java" checks="IllegalCatch"/>
 </suppressions>
diff --git a/gradle/dependencies.gradle b/gradle/dependencies.gradle
@@ -14,7 +14,7 @@ dependencies {
     runtimeOnly("org.springframework.boot:spring-boot-devtools")
 
     implementation("org.apache.poi:poi-ooxml:5.2.3")
-    implementation("org.apache.commons:commons-lang3:3.12.0")
+    implementation("org.apache.commons:commons-lang3:3.13.0")
     implementation("com.h2database:h2:2.1.214")
     implementation("org.dizitart:nitrite:3.4.4")
 

diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.2-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.2.1-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

diff --git a/src/main/java/com/quiz/darkhold/init/SecurityConfig.java b/src/main/java/com/quiz/darkhold/init/SecurityConfig.java
@@ -8,9 +8,12 @@
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
+import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
+import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
 
 @Configuration
 @EnableWebSecurity
@@ -29,22 +32,37 @@ public static BCryptPasswordEncoder passwordEncoder() {
     }
 
     @Bean
-    public SecurityFilterChain filterChain(final HttpSecurity http) throws Exception {
+    public SecurityFilterChain filterChain(final HttpSecurity http,
+                                           final HandlerMappingIntrospector introspector) throws Exception {
         //todo : we need to enable CSRF
         http.csrf(AbstractHttpConfigurer::disable);
-        http.authorizeHttpRequests(auth -> auth
-                        .requestMatchers(matchingPaths()).permitAll()
-                        .anyRequest().authenticated()
+        MvcRequestMatcher.Builder mvcMatcherBuilder = new MvcRequestMatcher.Builder(introspector);
+        for (var paths: matchingPaths()) {
+            http.authorizeHttpRequests(auth -> auth
+                    .requestMatchers(mvcMatcherBuilder.pattern(paths)).permitAll()
+            );
+        }
+        http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated());
+        http.formLogin(
+                (formLogin) -> {
+                    try {
+                        formLogin
+                                        //.loginPage("/authenticate")
+                                        .defaultSuccessUrl("/", true)
+                                        .permitAll()
+                                        .and()
+                                        .logout((logout) -> logout.logoutSuccessUrl("/")
+                                        .invalidateHttpSession(true)
+                                        .clearAuthentication(true)
+                                        .deleteCookies("JSESSIONID"));
+                    } catch (Exception ex) {
+                        //todo : clean up
+                        throw new RuntimeException(ex);
+                    }
+                });
+        http.headers(
+                (header) -> header.frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)
         );
-        http.formLogin().loginPage("/login")
-                .defaultSuccessUrl("/", true)
-                .permitAll()
-                .and()
-                .logout().logoutSuccessUrl("/")
-                .invalidateHttpSession(true)
-                .clearAuthentication(true)
-                .deleteCookies("JSESSIONID");
-        http.headers().frameOptions().sameOrigin();
         return http.build();
     }