FilterChain10ApiConfiguration.java

package com.tdmconsult.ete.configuration.securityfilterchain;

import com.tdmconsult.ete.configuration.CustomJwtAuthenticationConverter;
import java.util.List;
import lombok.extern.slf4j.Slf4j;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.cors.CorsConfiguration;
import org.springframework.web.cors.CorsConfigurationSource;
import org.springframework.web.cors.UrlBasedCorsConfigurationSource;

@Configuration
@Slf4j
public class FilterChain10ApiConfiguration {

    public static final String API_URL_PATTERN = "/api/**";

    @Value("${tdm.cors.allowed-origins}")
    private List<String> allowedOrigins;

    @Value("${tdm.cors.allowed-methods}")
    private List<String> allowedMethods;

    @Value("${tdm.cors.allowed-headers}")
    private List<String> allowedHeaders;

    @Bean
    @Order(10)
    public SecurityFilterChain filterChainToken(final HttpSecurity http) throws Exception {
        log.info("auto-configure OAuth2 WebSecurity for resource server");

        http
                // Nutzt die neue Lambda-basierte Konfiguration für Matcher
                .securityMatchers(matchers -> matchers.requestMatchers(API_URL_PATTERN))

                // Session-Management via Lambda
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))

                // CORS/CSRF via Lambda deaktivieren, da JWTs verwendet werden und keine Browser-Sessions vorliegen
                .cors(cors -> cors.configurationSource(corsConfigurationSource()))
                .csrf(AbstractHttpConfigurer::disable)

                // Authorisierungsregeln
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers(API_URL_PATTERN).authenticated() // Nur eingeloggte User
                        .anyRequest().permitAll() // Alle anderen Endpunkte (z.B. öffentliche Statusseiten) offen
                )

                // Aktiviert den Standard-JWT-Decoder mit den application.properties
                .oauth2ResourceServer(oauth2 ->
                        oauth2.jwt(jwt -> jwt.jwtAuthenticationConverter(new CustomJwtAuthenticationConverter())));

        return http.build();
    }

    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        final var configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(allowedOrigins);
        configuration.setAllowedMethods(allowedMethods);
        configuration.setAllowedHeaders(allowedHeaders);

        final var source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration(API_URL_PATTERN, configuration);
        return source;
    }
}