Skip to content
Snippets Groups Projects
Commit a35cf176 authored by Julian Horner's avatar Julian Horner
Browse files

Improve comments and add header details to response

parent 73f05b3e
No related branches found
No related tags found
No related merge requests found
...@@ -19,7 +19,7 @@ import org.springframework.security.core.userdetails.UserDetailsService; ...@@ -19,7 +19,7 @@ import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
/** /**
* Class that handles security configuration. * Class that enables custom security configuration.
* *
* @author Julian * @author Julian
* *
...@@ -32,7 +32,7 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter { ...@@ -32,7 +32,7 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Autowired @Autowired
private UserDetailsService userDetailsService; private UserDetailsService userDetailsService;
/** The configuration for the json web token. */ /** The <code>JwtConfig</code> for the json web token. */
@Autowired @Autowired
private JwtConfig jwtConfig; private JwtConfig jwtConfig;
...@@ -48,8 +48,12 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter { ...@@ -48,8 +48,12 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and() .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and()
// handle an authorized attempts // handle an authorized attempts
.exceptionHandling().authenticationEntryPoint( .exceptionHandling().authenticationEntryPoint(
(req, rsp, e) -> rsp.sendError(HttpServletResponse.SC_UNAUTHORIZED)) (req, rsp, e) -> {
.and() rsp.setContentType("application/json");
rsp.setCharacterEncoding("UTF-8");
rsp.sendError(HttpServletResponse.SC_UNAUTHORIZED);
}
).and()
/* /*
* Add a filter to validate user credentials and add token in the response header. * Add a filter to validate user credentials and add token in the response header.
...@@ -58,8 +62,8 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter { ...@@ -58,8 +62,8 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
* used to authenticate the user passing user's credentials. The filter needs this * used to authenticate the user passing user's credentials. The filter needs this
* authentication manager to authenticate the user. * authentication manager to authenticate the user.
*/ */
.addFilter( .addFilter(new JwtUsernameAndPasswordAuthenticationFilter(
new JwtUsernameAndPasswordAuthenticationFilter(authenticationManager(), jwtConfig)) authenticationManager(), jwtConfig))
.authorizeRequests() .authorizeRequests()
// allow all POST requests // allow all POST requests
.antMatchers(HttpMethod.POST, jwtConfig.getUri()).permitAll() .antMatchers(HttpMethod.POST, jwtConfig.getUri()).permitAll()
...@@ -67,13 +71,14 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter { ...@@ -67,13 +71,14 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
.anyRequest().authenticated(); .anyRequest().authenticated();
} }
// TODO improve comment
/** /**
* Spring has <code>UserDetailsService</code> interface, which can be overridden to provide our * Spring has <code>UserDetailsService</code> interface, which can be overridden to provide our
* implementation for fetching user from database (or any other source). * implementation for fetching user from database (or any other source).
* <p> * <p>
* The UserDetailsService object is used by the authentication manager to load the user * The <code>UserDetailsService</code> object is used by the authentication manager to load the
* from database. In addition, we need to define the password encoder also. So, authentication * user from database. In addition, we need to define the password encoder also. So,
* manager can compare and verify passwords. * authentication manager can compare and verify passwords.
*/ */
@Override @Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception { protected void configure(AuthenticationManagerBuilder auth) throws Exception {
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment