Examples with ProtocolEndpointWebSecurityConfigurer org.apereo.cas.web.ProtocolEndpointWebSecurityConfigurer used on opensource projects

Example 1 with ProtocolEndpointWebSecurityConfigurer

use of org.apereo.cas.web.ProtocolEndpointWebSecurityConfigurer in project cas by apereo.

the class CasWebSecurityConfigurerAdapter method configure.

/**
 * Disable Spring Security configuration for protocol endpoints
 * allowing CAS' own security configuration to handle protection
 * of endpoints where necessary.
 *
 * @param http http security
 */
@Override
protected void configure(final HttpSecurity http) throws Exception {
    http.csrf().disable().headers().disable().logout().disable().requiresChannel().requestMatchers(r -> r.getHeader("X-Forwarded-Proto") != null).requiresSecure();
    val requests = http.authorizeRequests().expressionHandler(casWebSecurityExpressionHandler);
    val patterns = protocolEndpointWebSecurityConfigurers.stream().filter(BeanSupplier::isNotProxy).map(ProtocolEndpointWebSecurityConfigurer::getIgnoredEndpoints).flatMap(List<String>::stream).map(endpoint -> StringUtils.prependIfMissing(endpoint, "/").concat("/**")).collect(Collectors.toList());
    patterns.add("/webjars/**");
    patterns.add("/js/**");
    patterns.add("/css/**");
    patterns.add("/images/**");
    patterns.add("/static/**");
    patterns.add("/error");
    patterns.add("/favicon.ico");
    LOGGER.debug("Configuring protocol endpoints [{}] to exclude/ignore from web security", patterns);
    requests.antMatchers(patterns.toArray(String[]::new)).permitAll();
    val endpoints = casProperties.getMonitor().getEndpoints().getEndpoint();
    endpoints.forEach(Unchecked.biConsumer((k, v) -> {
        val endpoint = EndpointRequest.to(k);
        v.getAccess().forEach(Unchecked.consumer(access -> configureEndpointAccess(http, requests, access, v, endpoint)));
    }));
    configureEndpointAccessToDenyUndefined(http, requests);
    configureEndpointAccessForStaticResources(requests);
    protocolEndpointWebSecurityConfigurers.forEach(cfg -> cfg.configure(http));
}