org.springframework.security.web.header.writers.StaticHeadersWriter Java Examples

@Override
protected void configure(HttpSecurity http) throws Exception {

    http.authorizeRequests()
            .regexMatchers("/chief/.*").hasRole("CHIEF")
            .regexMatchers("/agent/.*").access("hasRole('USER') and principal.name='James Bond'")
            .anyRequest().authenticated()
            .and().httpBasic()
            .and().requiresChannel().anyRequest().requiresSecure();

    http.exceptionHandling().accessDeniedPage("/accessDenied");

    http.formLogin().loginPage("/login").permitAll();

    http.logout().logoutUrl("/customlogout");

    //http.headers().disable();

    //http.header.defaultsDisabled();

    http.headers().cacheControl()
            .and().contentTypeOptions()
            .and().httpStrictTransportSecurity().includeSubDomains(true).maxAgeInSeconds(31536000)
            .and().httpPublicKeyPinning().includeSubDomains(true).reportUri("https://report-uri.io/") //<Reporting URL - https://report-uri.io/>.addSha256Pins("U3ByaW5nU2VjdXJpdHlJbkVhc3lTdGVwcw==") //< Base64 encoded Subject Public Key Information (SPKI) fingerprint >
            .and().xssProtection().block(false)
            .and().addHeaderWriter(new StaticHeadersWriter("Custom-Security-Header", "value"));
}
 

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
      .authorizeRequests()
      .antMatchers("/login*").permitAll()
      .antMatchers("/after_logout*").permitAll()
      .anyRequest().authenticated()
      .and()
      .formLogin()
      .loginPage("/login.html")
      .defaultSuccessUrl("/deptform.html")
      .failureUrl("/login.html?error=true")
      .and().logout().logoutUrl("/logout.html")
      .logoutSuccessUrl("/after_logout.html");
      
      
     
     http.csrf().disable();
   
     http.headers().defaultsDisabled().cacheControl()
     .and().httpStrictTransportSecurity()
     .and().contentTypeOptions().disable()
     .frameOptions().deny()
     .xssProtection().block(true)
     .and().addHeaderWriter(new StaticHeadersWriter("X-Content-Security-Policy","default-src 'self'"));
    
    
}
 

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
      .authorizeRequests()
      .antMatchers("/login*").permitAll()
      .antMatchers("/after_logout*").permitAll()
      .anyRequest().authenticated()
      .and()
      .formLogin()
      .loginPage("/login.html")
      .defaultSuccessUrl("/deptform.html")
      .failureUrl("/login.html?error=true")
      .and().logout().logoutUrl("/logout.html")
      .logoutSuccessUrl("/after_logout.html");
      
      
     
     http.csrf().disable();
   
     http.headers().defaultsDisabled().cacheControl()
     .and().httpStrictTransportSecurity()
     .and().contentTypeOptions().disable()
     .frameOptions().deny()
     .xssProtection().block(true)
     .and().addHeaderWriter(new StaticHeadersWriter("X-Content-Security-Policy","default-src 'self'"));
    
    
}
 

@Override
protected void configure(HttpSecurity http) throws Exception {
  http
    .headers()
      .addHeaderWriter(
        new LogSearchCompositeHeaderWriter("https".equals(logSearchHttpConfig.getProtocol()),
          new XXssProtectionHeaderWriter(),
          new XFrameOptionsHeaderWriter(XFrameOptionsHeaderWriter.XFrameOptionsMode.DENY),
          new XContentTypeOptionsHeaderWriter(),
          new StaticHeadersWriter("Pragma", "no-cache"),
          new StaticHeadersWriter("Cache-Control", "no-store")))
    .and()
    .csrf().disable()
    .authorizeRequests()
      .requestMatchers(requestMatcher())
        .permitAll()
      .antMatchers("/**")
        .hasRole("USER")
    .and()
    .authenticationProvider(logsearchAuthenticationProvider())
    .httpBasic()
      .authenticationEntryPoint(logsearchAuthenticationEntryPoint())
    .and()
    .addFilterBefore(logsearchTrustedProxyFilter(), BasicAuthenticationFilter.class)
    .addFilterAfter(logsearchKRBAuthenticationFilter(), LogsearchTrustedProxyFilter.class)
    .addFilterBefore(logsearchUsernamePasswordAuthenticationFilter(), LogsearchKRBAuthenticationFilter.class)
    .addFilterAfter(securityContextFormationFilter(), FilterSecurityInterceptor.class)
    .addFilterAfter(logsearchMetadataFilter(), LogsearchSecurityContextFormationFilter.class)
    .addFilterAfter(logsearchAuditLogFilter(), LogsearchSecurityContextFormationFilter.class)
    .addFilterAfter(logsearchServiceLogFilter(), LogsearchSecurityContextFormationFilter.class)
    .addFilterAfter(logSearchConfigStateFilter(), LogsearchSecurityContextFormationFilter.class)
    .addFilterBefore(logsearchCorsFilter(), LogsearchSecurityContextFormationFilter.class)
    .addFilterBefore(logsearchJwtFilter(), LogsearchSecurityContextFormationFilter.class)
    .logout()
      .logoutUrl("/logout")
      .deleteCookies(getCookies())
      .logoutSuccessHandler(new LogsearchLogoutSuccessHandler());

  if ((logSearchConfigApiConfig.isSolrFilterStorage() || logSearchConfigApiConfig.isZkFilterStorage())
          && !logSearchConfigApiConfig.isConfigApiEnabled())
    http.addFilterAfter(logSearchLogLevelFilterManagerFilter(), LogsearchSecurityContextFormationFilter.class);
}
 

protected void configure(HttpSecurity httpSecurity) throws Exception {
    //@formatter:off
    httpSecurity
            .authorizeRequests().anyRequest().authenticated()
            .and()
                .headers()
            .addHeaderWriter(new StaticHeadersWriter(HeadersUtil.CONTENT_SEC_POLICY_KEY, HeadersUtil.headerMap.get(HeadersUtil.CONTENT_SEC_POLICY_KEY)))
            .addHeaderWriter(new StaticHeadersWriter(SERVER_KEY, HeadersUtil.headerMap.get(SERVER_KEY)))
                    .and()
                .servletApi()
            .and()
                .csrf().disable()
                .sessionManagement()
                .enableSessionUrlRewriting(false)
                .sessionCreationPolicy(SessionCreationPolicy.ALWAYS)
                .sessionFixation()
                .newSession()
            .and()
            .httpBasic()
            .authenticationEntryPoint(getDelegatingAuthenticationEntryPoint())
            .and()
                .formLogin()
                    .loginPage("/login.jsp")
                    .loginProcessingUrl("/j_spring_security_check")
                    .successHandler(successHandler)
                    .failureHandler(failureHandler)
                    .usernameParameter("j_username")
                    .passwordParameter("j_password")
            .and()
                .logout()
                    .logoutSuccessUrl("/login.jsp")
                    .deleteCookies("ATLASSESSIONID")
                    .logoutUrl("/logout.html");

    //@formatter:on

    boolean configMigrationEnabled = !StringUtils.isEmpty(configuration.getString(ATLAS_MIGRATION_MODE_FILENAME));
    if (configuration.getBoolean("atlas.server.ha.enabled", false) ||
            configMigrationEnabled) {
        if(configMigrationEnabled) {
            LOG.info("Atlas is in Migration Mode, enabling ActiveServerFilter");
        } else {
            LOG.info("Atlas is in HA Mode, enabling ActiveServerFilter");
        }
        httpSecurity.addFilterAfter(activeServerFilter, BasicAuthenticationFilter.class);
    }
    httpSecurity
            .addFilterAfter(staleTransactionCleanupFilter, BasicAuthenticationFilter.class)
            .addFilterBefore(ssoAuthenticationFilter, BasicAuthenticationFilter.class)
            .addFilterAfter(atlasAuthenticationFilter, SecurityContextHolderAwareRequestFilter.class)
            .addFilterAfter(csrfPreventionFilter, AtlasAuthenticationFilter.class);

    if (keycloakEnabled) {
        httpSecurity
          .logout().addLogoutHandler(keycloakLogoutHandler()).and()
          .addFilterBefore(keycloakAuthenticationProcessingFilter(), BasicAuthenticationFilter.class)
          .addFilterBefore(keycloakPreAuthActionsFilter(), LogoutFilter.class)
          .addFilterAfter(keycloakSecurityContextRequestFilter(), SecurityContextHolderAwareRequestFilter.class)
          .addFilterAfter(keycloakAuthenticatedActionsRequestFilter(), KeycloakSecurityContextRequestFilter.class);
    }
}
 

/**
 * {@inheritDoc}
 * 
 * Initializes the default {@link UserDetailsService} causing the {@link AuthenticationManagerBuilder} 
 * creates automatically the {@link DaoAuthenticationProvider} that delegates on the given
 * {@link UserDetailsService}.
 * 
 * Also setup the {@link BCryptPasswordEncoder} to use with the {@link DaoAuthenticationProvider}
 */
@Override
protected void configure(HttpSecurity http) throws Exception {

  // Session management
  
  if (disableConcurrency) {
    http.sessionManagement().maximumSessions(1).expiredUrl("/login?expired");
  }

  // CSP settings

  http
    .headers()
      .addHeaderWriter(new StaticHeadersWriter(X_CONTENT_SECURITY_POLICY_HEADER,
          DEFAULT_POLICY_DIRECTIVES))
      .addHeaderWriter(new StaticHeadersWriter(CONTENT_SECURITY_POLICY_HEADER,
          DEFAULT_POLICY_DIRECTIVES))
      .addHeaderWriter(
          new StaticHeadersWriter(X_WEBKIT_CSP_POLICY_HEADER, DEFAULT_POLICY_DIRECTIVES));

  // Authentication

  http
    .authorizeRequests()
      .antMatchers("/public/**", "/webjars/**", "/resources/**", "/static/**", "/login/**").permitAll()
      .anyRequest().authenticated()
      .and()
    .formLogin()
      .loginPage(LOGIN_FORM_URL)
      .permitAll()
      .and()
    .logout()
      .permitAll();

  // IMPORTANT: loginPage() will set the URL path to which redirect to
  // identify the user it does NOT create the method that handles the 
  // request.

  // se añade redirección personalizada en caso de excepción por acceso no autorizado
  http
    .exceptionHandling()
      .authenticationEntryPoint(new SpringletsSecurityWebAuthenticationEntryPoint())
    .accessDeniedHandler(new SpringletsSecurityWebAccessDeniedHandlerImpl());

}