Revize 2fb633dc

Changed security

backend/src/main/java/cz/zcu/kiv/backendapi/security/SecurityConfig.java

@@ -43 +43 @@
     /**
      * List of permitted pages without login
      */
-    private final String[] permittedUrls = new String[]{"/login", "/token/refresh", "/register", "/swagger-ui/**",
+    private final String[] permittedUrls = new String[]{"/login", "/users/token", "/register", "/swagger-ui/**",
             "/swagger-ui.html", "/v3/api-docs", "/v3/api-docs/swagger-config"};
 
     /**
@@ -58 +58 @@
                 csrf().disable()
                 .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                 .and()
+                .addFilter(new JwtUsernameAndPasswordAuthenticationFilter(authenticationManager(), jwtUtils))
+                .addFilterAfter(new JwtTokenVerifier(jwtUtils, permittedUrls), JwtUsernameAndPasswordAuthenticationFilter.class)
                 .authorizeRequests()
                 .antMatchers(permittedUrls).permitAll()
                 .antMatchers("/user/update-permissions/**", "/user/reset-password/**").hasRole(Role.ADMIN.name())
@@ -66 +68 @@
                 .antMatchers("/read/**").hasAuthority(Permission.READ.name())
                 .antMatchers("/delete/**").hasAuthority(Permission.DELETE.name())
                 .anyRequest()
-                .authenticated()
-                .and()
-                .logout()
-                .and()
-                .addFilter(new JwtUsernameAndPasswordAuthenticationFilter(authenticationManager(), jwtUtils))
-                .addFilterAfter(new JwtTokenVerifier(jwtUtils, permittedUrls), JwtUsernameAndPasswordAuthenticationFilter.class);
+                .authenticated();
 
     }