@Configuration
@EnableWebSecurity
//@EnableOAuth2Sso
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private AuthUserService authUserService;
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.csrf().disable()
.authorizeRequests()
.antMatchers("/admin", "/user", "/new-event", "/dict/**", "/data/**").authenticated() // только для зарегистрированных
.antMatchers("/**", "/static/**", "/publish/**").permitAll() // общий доступ
.anyRequest().authenticated() // только для зарегистрированных
.and();
http.formLogin()
.loginPage("/login")
.failureUrl("/login?error")
.permitAll()
.and();
http.logout()
.permitAll()
.logoutUrl("/logout")
.logoutSuccessUrl("/")
.invalidateHttpSession(true);
}
@Override
protected void configure(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
authenticationManagerBuilder.userDetailsService(authUserService)
.passwordEncoder(NoOpPasswordEncoder.getInstance());
}
}
