shardegger/storycove
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

revert security config

Browse Source
This commit is contained in:
Stefan Hardegger
2025-08-12 15:14:14 +02:00
parent c46108c317
commit 142d8328c2
2 changed files with 7 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
backend/src/main/java/com/storycove/config/SecurityConfig.java
View File

@@ -7,7 +7,6 @@ import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder;
@@ -39,20 +38,6 @@ public class SecurityConfig {
.cors(cors -> cors.configurationSource(corsConfigurationSource())) .cors(cors -> cors.configurationSource(corsConfigurationSource()))
.csrf(AbstractHttpConfigurer::disable) .csrf(AbstractHttpConfigurer::disable)
.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.headers(headers -> headers
.frameOptions().deny()
.contentTypeOptions().and()
.contentSecurityPolicy("default-src 'self'; " +
"script-src 'self' 'unsafe-inline' 'unsafe-eval'; " +
"style-src 'self' 'unsafe-inline'; " +
"img-src 'self' data: blob:; " +
"font-src 'self'; " +
"connect-src 'self'; " +
"media-src 'self'; " +
"object-src 'none'; " +
"frame-src 'none'; " +
"base-uri 'self'")
)
.authorizeHttpRequests(authz -> authz .authorizeHttpRequests(authz -> authz
// Public endpoints // Public endpoints
.requestMatchers("/api/auth/**").permitAll() .requestMatchers("/api/auth/**").permitAll()

16
backend/src/main/java/com/storycove/util/JwtUtil.java
View File

@@ -1,10 +1,9 @@
package com.storycove.util; package com.storycove.util;
import com.storycove.config.SecurityProperties;
import io.jsonwebtoken.Claims; import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts; import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.security.Keys; import io.jsonwebtoken.security.Keys;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component; import org.springframework.stereotype.Component;
import javax.crypto.SecretKey; import javax.crypto.SecretKey;
@@ -13,20 +12,19 @@ import java.util.Date;
@Component @Component
public class JwtUtil { public class JwtUtil {
private final SecurityProperties securityProperties; @Value("${storycove.jwt.secret}")
private String secret;
@Autowired @Value("${storycove.jwt.expiration:86400000}") // 24 hours default
public JwtUtil(SecurityProperties securityProperties) { private Long expiration;
this.securityProperties = securityProperties;
}
private SecretKey getSigningKey() { private SecretKey getSigningKey() {
return Keys.hmacShaKeyFor(securityProperties.getJwt().getSecret().getBytes()); return Keys.hmacShaKeyFor(secret.getBytes());
} }
public String generateToken() { public String generateToken() {
Date now = new Date(); Date now = new Date();
Date expiryDate = new Date(now.getTime() + securityProperties.getJwt().getExpiration()); Date expiryDate = new Date(now.getTime() + expiration);
return Jwts.builder() return Jwts.builder()
.subject("user") .subject("user")