From bdb708c15d208b7d507f064d42628ba126ce77d0 Mon Sep 17 00:00:00 2001 From: Jim Martens Date: Sat, 9 Aug 2025 18:57:06 +0200 Subject: [PATCH] security: Remove policy enforcer from URLs --- .../timetable/configuration/WebSecurityConfiguration.kt | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/module-server/src/main/kotlin/de/twomartens/timetable/configuration/WebSecurityConfiguration.kt b/module-server/src/main/kotlin/de/twomartens/timetable/configuration/WebSecurityConfiguration.kt index dd19cd3..a3cf02f 100644 --- a/module-server/src/main/kotlin/de/twomartens/timetable/configuration/WebSecurityConfiguration.kt +++ b/module-server/src/main/kotlin/de/twomartens/timetable/configuration/WebSecurityConfiguration.kt @@ -17,7 +17,6 @@ import org.springframework.security.config.annotation.web.configuration.EnableWe import org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer import org.springframework.security.oauth2.jwt.JwtDecoder import org.springframework.security.oauth2.jwt.NimbusJwtDecoder -import org.springframework.security.oauth2.server.resource.web.authentication.BearerTokenAuthenticationFilter import org.springframework.security.web.SecurityFilterChain import java.io.IOException @@ -37,9 +36,8 @@ open class WebSecurityConfiguration { .csrf { it.disable() } .authorizeHttpRequests { it.requestMatchers(*PERMITTED_PATHS.toTypedArray()).permitAll() } .authorizeHttpRequests { it.requestMatchers(HttpMethod.OPTIONS).permitAll() } - .authorizeHttpRequests { it.anyRequest().authenticated() } + .authorizeHttpRequests { it.anyRequest().permitAll() } .oauth2ResourceServer { obj: OAuth2ResourceServerConfigurer -> obj.jwt(Customizer.withDefaults()) } - .addFilterAfter(createPolicyEnforcerFilter(), BearerTokenAuthenticationFilter::class.java) return http.build() }