treshenkov/clearing
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

добавил Access-Control-Allow-Methods, Access-Control-Allow-Headers, пока *

Browse source 
добавил настройку для SameSite
This commit is contained in:
ialbert 2022-10-27 09:38:11 +03:00
parent b5cac139a8
commit 03a7f1056a
3 changed files with 29 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/config/WebConfig.java
View file

@ -2,6 +2,7 @@ package ru.spcex.clearing.backendapi.config;
import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.boot.web.server.Cookie;
import org.springframework.boot.web.server.WebServerFactoryCustomizer; import org.springframework.boot.web.server.WebServerFactoryCustomizer;
import org.springframework.boot.web.servlet.server.ConfigurableServletWebServerFactory; import org.springframework.boot.web.servlet.server.ConfigurableServletWebServerFactory;
import org.springframework.boot.web.servlet.server.CookieSameSiteSupplier; import org.springframework.boot.web.servlet.server.CookieSameSiteSupplier;
@ -13,6 +14,7 @@ import org.springframework.http.converter.json.MappingJackson2HttpMessageConvert
import org.springframework.web.bind.annotation.CrossOrigin; import org.springframework.web.bind.annotation.CrossOrigin;
import org.springframework.web.context.request.RequestContextListener; import org.springframework.web.context.request.RequestContextListener;
import org.springframework.web.servlet.config.annotation.*; import org.springframework.web.servlet.config.annotation.*;
import ru.spcex.clearing.backendapi.config.element.BackendApiSettings;
import java.util.List; import java.util.List;
import java.util.function.Consumer; import java.util.function.Consumer;
@ -24,10 +26,14 @@ import java.util.function.Consumer;
@CrossOrigin @CrossOrigin
public class WebConfig implements WebMvcConfigurer { public class WebConfig implements WebMvcConfigurer {
private final MappingJackson2HttpMessageConverter customJsonHttpConverter; private final MappingJackson2HttpMessageConverter customJsonHttpConverter;
private final String sameSite;
@Autowired @Autowired
public WebConfig(@Qualifier("customJsonHttpConverter") MappingJackson2HttpMessageConverter customJsonHttpConverter) { public WebConfig(@Qualifier("customJsonHttpConverter") MappingJackson2HttpMessageConverter customJsonHttpConverter,
BackendApiSettings backendSettings
) {
this.customJsonHttpConverter = customJsonHttpConverter; this.customJsonHttpConverter = customJsonHttpConverter;
this.sameSite = backendSettings.getSecurity().getSameSite();
} }
@Override @Override
@ -79,6 +85,16 @@ public class WebConfig implements WebMvcConfigurer {
@Bean @Bean
public CookieSameSiteSupplier applicationCookieSameSiteSupplier() { public CookieSameSiteSupplier applicationCookieSameSiteSupplier() {
return CookieSameSiteSupplier.ofNone(); if (sameSite == null) {
return null;
} else if (sameSite.equalsIgnoreCase(Cookie.SameSite.NONE.attributeValue())) {
return CookieSameSiteSupplier.ofNone();
} else if (sameSite.equalsIgnoreCase(Cookie.SameSite.LAX.attributeValue())) {
return CookieSameSiteSupplier.ofNone();
} else if (sameSite.equalsIgnoreCase(Cookie.SameSite.STRICT.attributeValue())) {
return CookieSameSiteSupplier.ofStrict();
} else {
throw new IllegalStateException("unknown SameSite setting");
}
} }
} }

4
clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/filter/ClearingCorsFilter.java
View file

@ -70,7 +70,7 @@ public class ClearingCorsFilter extends OncePerRequestFilter {
// } else { // } else {
// methods = "*"; // methods = "*";
// } // }
// setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_METHODS, methods); setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_METHODS, "*");
// String headers; // String headers;
// if (head.length > 0) { // if (head.length > 0) {
@ -78,7 +78,7 @@ public class ClearingCorsFilter extends OncePerRequestFilter {
// } else { // } else {
// headers = "*"; // headers = "*";
// } // }
// setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_HEADERS, headers); setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_HEADERS, "*");
setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_CREDENTIALS, "true"); setHeaderValue(httpServletResponse, H_ACCESS_CONTROL_ALLOW_CREDENTIALS, "true");
log.trace("cors filter -> added ok"); log.trace("cors filter -> added ok");

9
clearing-parent/backend-api/src/main/java/ru/spcex/clearing/backendapi/security/element/SecuritySettings.java
View file

@ -2,6 +2,7 @@ package ru.spcex.clearing.backendapi.security.element;
public class SecuritySettings { public class SecuritySettings {
private Boolean authorizationDisabled = false; private Boolean authorizationDisabled = false;
private String sameSite;
public Boolean getAuthorizationDisabled() { public Boolean getAuthorizationDisabled() {
return authorizationDisabled; return authorizationDisabled;
@ -10,4 +11,12 @@ public class SecuritySettings {
public void setAuthorizationDisabled(Boolean authorizationDisabled) { public void setAuthorizationDisabled(Boolean authorizationDisabled) {
this.authorizationDisabled = authorizationDisabled; this.authorizationDisabled = authorizationDisabled;
} }
public String getSameSite() {
return sameSite;
}
public void setSameSite(String sameSite) {
this.sameSite = sameSite;
}
} }