From 03a7f1056ab9c3568f0d4857e2554b7eda94daab Mon Sep 17 00:00:00 2001 From: ialbert Date: Thu, 27 Oct 2022 09:38:11 +0300 Subject: [PATCH] =?UTF-8?q?=D0=B4=D0=BE=D0=B1=D0=B0=D0=B2=D0=B8=D0=BB=20Ac?= =?UTF-8?q?cess-Control-Allow-Methods,=20Access-Control-Allow-Headers,=20?= =?UTF-8?q?=D0=BF=D0=BE=D0=BA=D0=B0=20*=20=D0=B4=D0=BE=D0=B1=D0=B0=D0=B2?= =?UTF-8?q?=D0=B8=D0=BB=20=D0=BD=D0=B0=D1=81=D1=82=D1=80=D0=BE=D0=B9=D0=BA?= =?UTF-8?q?=D1=83=20=D0=B4=D0=BB=D1=8F=20SameSite?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../clearing/backendapi/config/WebConfig.java | 20 +++++++++++++++++-- .../backendapi/filter/ClearingCorsFilter.java | 4 ++-- .../security/element/SecuritySettings.java | 9 +++++++++ 3 files changed, 29 insertions(+), 4 deletions(-) diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java index 1cc5893df..a3a296a94 100644 --- a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java +++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java @@ -2,6 +2,7 @@ package ru.spcex.clearing.backendapi.config; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; +import org.springframework.boot.web.server.Cookie; import org.springframework.boot.web.server.WebServerFactoryCustomizer; import org.springframework.boot.web.servlet.server.ConfigurableServletWebServerFactory; import org.springframework.boot.web.servlet.server.CookieSameSiteSupplier; @@ -13,6 +14,7 @@ import org.springframework.http.converter.json.MappingJackson2HttpMessageConvert import org.springframework.web.bind.annotation.CrossOrigin; import org.springframework.web.context.request.RequestContextListener; import org.springframework.web.servlet.config.annotation.*; +import ru.spcex.clearing.backendapi.config.element.BackendApiSettings; import java.util.List; import java.util.function.Consumer; @@ -24,10 +26,14 @@ import java.util.function.Consumer; @CrossOrigin public class WebConfig implements WebMvcConfigurer { private final MappingJackson2HttpMessageConverter customJsonHttpConverter; + private final String sameSite; @Autowired - public WebConfig(@Qualifier("customJsonHttpConverter") MappingJackson2HttpMessageConverter customJsonHttpConverter) { + public WebConfig(@Qualifier("customJsonHttpConverter") MappingJackson2HttpMessageConverter customJsonHttpConverter, + BackendApiSettings backendSettings + ) { this.customJsonHttpConverter = customJsonHttpConverter; + this.sameSite = backendSettings.getSecurity().getSameSite(); } @Override @@ -79,6 +85,16 @@ public class WebConfig implements WebMvcConfigurer { @Bean public CookieSameSiteSupplier applicationCookieSameSiteSupplier() { - return CookieSameSiteSupplier.ofNone(); + if (sameSite == null) { + return null; + } else if (sameSite.equalsIgnoreCase(Cookie.SameSite.NONE.attributeValue())) { + return CookieSameSiteSupplier.ofNone(); + } else if (sameSite.equalsIgnoreCase(Cookie.SameSite.LAX.attributeValue())) { + return CookieSameSiteSupplier.ofNone(); + } else if (sameSite.equalsIgnoreCase(Cookie.SameSite.STRICT.attributeValue())) { + return CookieSameSiteSupplier.ofStrict(); + } else { + throw new IllegalStateException("unknown SameSite setting"); + } } } diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java index e805b0671..b0346ffd0 100644 --- a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java +++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java @@ -70,7 +70,7 @@ public class ClearingCorsFilter extends OncePerRequestFilter { // } else { // methods = "*"; // } -// setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_METHODS, methods); + setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_METHODS, "*"); // String headers; // if (head.length > 0) { @@ -78,7 +78,7 @@ public class ClearingCorsFilter extends OncePerRequestFilter { // } else { // headers = "*"; // } -// setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_HEADERS, headers); + setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_HEADERS, "*"); setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_CREDENTIALS, "true"); log.trace("cors filter -> added ok"); diff --git a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/element/SecuritySettings.java b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/element/SecuritySettings.java index d2b48b879..ac66f3ee8 100644 --- a/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/element/SecuritySettings.java +++ b/clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/element/SecuritySettings.java @@ -2,6 +2,7 @@ package ru.spcex.clearing.backendapi.security.element; public class SecuritySettings { private Boolean authorizationDisabled = false; + private String sameSite; public Boolean getAuthorizationDisabled() { return authorizationDisabled; @@ -10,4 +11,12 @@ public class SecuritySettings { public void setAuthorizationDisabled(Boolean authorizationDisabled) { this.authorizationDisabled = authorizationDisabled; } + + public String getSameSite() { + return sameSite; + } + + public void setSameSite(String sameSite) { + this.sameSite = sameSite; + } }