Revize cc2e05e8

re #29 reject unauthenticated connections instead of redirecting to login page

server/src/main/java/org/danekja/ymanager/WebSecurityConfiguration.java

@@ -7 +7 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.http.HttpStatus;
 import org.springframework.security.authentication.AuthenticationProvider;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.authentication.dao.AbstractUserDetailsAuthenticationProvider;
@@ -19 +20 @@
 import org.springframework.security.oauth2.client.oidc.userinfo.OidcUserRequest;
 import org.springframework.security.oauth2.client.userinfo.OAuth2UserService;
 import org.springframework.security.oauth2.core.oidc.user.OidcUser;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.security.web.authentication.HttpStatusEntryPoint;
 
 @Configuration
 @EnableWebSecurity
@@ -27 +30 @@
     @Autowired
     private OAuth2UserService<OidcUserRequest, OidcUser> googleOauthUserService;
 
+    @Autowired
+    private AuthenticationEntryPoint restAuthenticationEntryPoint;
+
     @Override
     protected void configure(HttpSecurity http) throws Exception {
         http.cors()
                 .and()
                 .csrf().disable()
                 .authorizeRequests()
+                .mvcMatchers("/login/*").permitAll()
                 .anyRequest().authenticated()
                 .and()
+                .exceptionHandling().authenticationEntryPoint(restAuthenticationEntryPoint)
+                .and()
                 .oauth2Login()
                 .userInfoEndpoint().oidcUserService(googleOauthUserService);
     }
@@ -44 +53 @@
         return new GoogleOidcUserService(userManager);
     }
 
+
+    /**
+     * @return reject guest users instead of redirection to login page
+     */
+    @Bean
+    public AuthenticationEntryPoint restAuthenticationEntryPoint() {
+        return new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED);
+    }
+
     /**
      * This is a dummy authentication provider which does not check password at all.
      * <p>