FilterChain40DevToolsConfiguration.java

package com.tdmconsult.ete.configuration.securityfilterchain;

import java.util.stream.Stream;
import lombok.extern.slf4j.Slf4j;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher;

@Configuration
@Slf4j
public class FilterChain40DevToolsConfiguration {

    @Bean
    @Order(40)
    public SecurityFilterChain devToolsFilterChain(final HttpSecurity http) throws Exception {

        return http
                .securityMatchers(matchers -> matchers.requestMatchers(
                        Stream.of(
                                        "/h2-console/**",
                                        "/swagger",
                                        "/openapi",
                                        "/swagger-ui/**",
                                        "/openapi/swagger-config",
                                        "/v3/api-docs/**",
                                        "/swagger-ui.html"
                                )
                                .map(path -> PathPatternRequestMatcher.withDefaults().matcher(path))
                                .toArray(RequestMatcher[]::new)
                ))

                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .csrf(AbstractHttpConfigurer::disable)
                .headers(headers -> headers.frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin))
                .authorizeHttpRequests(auth -> auth.anyRequest().permitAll())
                .build();
    }
}