1515 */
1616package com .example ;
1717
18- import java .io .IOException ;
1918import java .security .Principal ;
2019import java .util .List ;
2120import java .util .Map ;
2221
23- import javax .servlet .Filter ;
24- import javax .servlet .FilterChain ;
25- import javax .servlet .ServletException ;
26- import javax .servlet .http .Cookie ;
27- import javax .servlet .http .HttpServletRequest ;
28- import javax .servlet .http .HttpServletResponse ;
29-
3022import org .springframework .boot .SpringApplication ;
3123import org .springframework .boot .autoconfigure .SpringBootApplication ;
3224import org .springframework .boot .autoconfigure .security .oauth2 .client .EnableOAuth2Sso ;
3325import org .springframework .boot .autoconfigure .security .oauth2 .resource .AuthoritiesExtractor ;
3426import org .springframework .boot .context .embedded .EmbeddedServletContainerCustomizer ;
35- import org .springframework .boot .context . embedded .ErrorPage ;
27+ import org .springframework .boot .web . servlet .ErrorPage ;
3628import org .springframework .context .annotation .Bean ;
3729import org .springframework .context .annotation .Configuration ;
3830import org .springframework .http .HttpStatus ;
3931import org .springframework .security .authentication .BadCredentialsException ;
4032import org .springframework .security .config .annotation .web .builders .HttpSecurity ;
4133import org .springframework .security .config .annotation .web .configuration .WebSecurityConfigurerAdapter ;
4234import org .springframework .security .core .authority .AuthorityUtils ;
35+ import org .springframework .security .oauth2 .client .OAuth2ClientContext ;
4336import org .springframework .security .oauth2 .client .OAuth2RestOperations ;
44- import org .springframework .security .web .csrf .CsrfFilter ;
45- import org .springframework .security .web .csrf .CsrfToken ;
46- import org .springframework .security .web .csrf .CsrfTokenRepository ;
47- import org .springframework .security .web .csrf .HttpSessionCsrfTokenRepository ;
37+ import org .springframework .security .oauth2 .client .OAuth2RestTemplate ;
38+ import org .springframework .security .oauth2 .client .resource .OAuth2ProtectedResourceDetails ;
39+ import org .springframework .security .web .csrf .CookieCsrfTokenRepository ;
4840import org .springframework .stereotype .Controller ;
4941import org .springframework .web .bind .annotation .RequestMapping ;
5042import org .springframework .web .bind .annotation .ResponseBody ;
51- import org .springframework .web .filter .OncePerRequestFilter ;
52- import org .springframework .web .util .WebUtils ;
5343
5444@ SpringBootApplication
5545@ EnableOAuth2Sso
5646@ Controller
5747public class SocialApplication extends WebSecurityConfigurerAdapter {
5848
49+ @ Bean
50+ public OAuth2RestTemplate oauth2RestTemplate (OAuth2ProtectedResourceDetails resource , OAuth2ClientContext context ) {
51+ return new OAuth2RestTemplate (resource , context );
52+ }
53+
5954@ Bean
6055public AuthoritiesExtractor authoritiesExtractor (OAuth2RestOperations template ) {
6156return map -> {
6257String url = (String ) map .get ("organizations_url" );
6358@ SuppressWarnings ("unchecked" )
6459List <Map <String , Object >> orgs = template .getForObject (url , List .class );
65- if (orgs .stream ()
66- .anyMatch (org -> "spring-projects" .equals (org .get ("login" )))) {
60+ if (orgs .stream ().anyMatch (org -> "spring-projects" .equals (org .get ("login" )))) {
6761return AuthorityUtils .commaSeparatedStringToAuthorityList ("ROLE_USER" );
6862}
6963throw new BadCredentialsException ("Not in Spring Team" );
@@ -84,12 +78,9 @@ public String unauthenticated() {
8478@ Override
8579protected void configure (HttpSecurity http ) throws Exception {
8680// @formatter:off
87- http .antMatcher ("/**" ).authorizeRequests ()
88- .antMatchers ("/" , "/login**" , "/webjars/**" ).permitAll ()
89- .anyRequest ().authenticated ().and ()
90- .logout ().logoutSuccessUrl ("/" ).permitAll ().and ()
91- .csrf ().csrfTokenRepository (csrfTokenRepository ()).and ()
92- .addFilterAfter (csrfHeaderFilter (), CsrfFilter .class );
81+ http .antMatcher ("/**" ).authorizeRequests ().antMatchers ("/" , "/login**" , "/webjars/**" ).permitAll ().anyRequest ()
82+ .authenticated ().and ().logout ().logoutSuccessUrl ("/" ).permitAll ().and ().csrf ()
83+ .csrfTokenRepository (CookieCsrfTokenRepository .withHttpOnlyFalse ());
9384// @formatter:on
9485}
9586
@@ -98,8 +89,7 @@ protected static class ServletCustomizer {
9889@ Bean
9990public EmbeddedServletContainerCustomizer customizer () {
10091return container -> {
101- container .addErrorPages (
102- new ErrorPage (HttpStatus .UNAUTHORIZED , "/unauthenticated" ));
92+ container .addErrorPages (new ErrorPage (HttpStatus .UNAUTHORIZED , "/unauthenticated" ));
10393};
10494}
10595}
@@ -108,33 +98,4 @@ public static void main(String[] args) {
10898SpringApplication .run (SocialApplication .class , args );
10999}
110100
111- private Filter csrfHeaderFilter () {
112- return new OncePerRequestFilter () {
113- @ Override
114- protected void doFilterInternal (HttpServletRequest request ,
115- HttpServletResponse response , FilterChain filterChain )
116- throws ServletException , IOException {
117- CsrfToken csrf = (CsrfToken ) request
118- .getAttribute (CsrfToken .class .getName ());
119- if (csrf != null ) {
120- Cookie cookie = WebUtils .getCookie (request , "XSRF-TOKEN" );
121- String token = csrf .getToken ();
122- if (cookie == null
123- || token != null && !token .equals (cookie .getValue ())) {
124- cookie = new Cookie ("XSRF-TOKEN" , token );
125- cookie .setPath ("/" );
126- response .addCookie (cookie );
127- }
128- }
129- filterChain .doFilter (request , response );
130- }
131- };
132- }
133-
134- private CsrfTokenRepository csrfTokenRepository () {
135- HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository ();
136- repository .setHeaderName ("X-XSRF-TOKEN" );
137- return repository ;
138- }
139-
140101}
0 commit comments