Revize 59e25e67

#10365 - vytváření endpointu pro refresh tokenu. Token se vytvoří nový s platností na 1 h a starý se znevaliduje.

.idea/inspectionProfiles/Project_Default.xml

@@ +1 @@
+<component name="InspectionProjectProfileManager">
+  <profile version="1.0">
+    <option name="myName" value="Project Default" />
+    <inspection_tool class="Eslint" enabled="true" level="WARNING" enabled_by_default="true" />
+  </profile>
+</component>

src/main/java/cz/zcu/fav/kiv/antipatterndetectionapp/v2/config/WebConfig.java

@@ -13 +13 @@
         return new WebMvcConfigurer() {
             @Override
             public void addCorsMappings(CorsRegistry registry) {
-                registry.addMapping("/**").allowedOrigins("*");
+                registry.addMapping("/**")
+                        .allowedOrigins("http://localhost:3000")
+                        .allowCredentials(true);
             }
         };
     }

src/main/java/cz/zcu/fav/kiv/antipatterndetectionapp/v2/controller/UserController.java

@@ -88 +88 @@
         return aOuthService.logoutUser(user);
     }
 
+    @GetMapping("/refresh")
+    public ResponseEntity<String> refreshToken(@RequestHeader HttpHeaders headers) {
+        final String authHeader = headers.getFirst(HttpHeaders.AUTHORIZATION);
+        if (authHeader == null || !authHeader.startsWith("Bearer")) {
+            // err
+        }
+        final String token = authHeader.substring(7);
+
+        String jwtToken = null;
+        ResponseEntity<String> response = aOuthService.refreshToken(token);
+
+        if (response.getStatusCode().is2xxSuccessful()) {
+            jwtToken = response.getBody();
+            return getResponseEntity(UserModelStatusCodes.TOKEN_REFRESHED,jwtToken);
+        }
+
+        return getResponseEntity(UserModelStatusCodes.TOKEN_EXPIRED, UserModelStatusCodes.TOKEN_EXPIRED.getLabel());
+
+    }
+
     /**
      * Method to create response
      *

src/main/java/cz/zcu/fav/kiv/antipatterndetectionapp/v2/httpExceptions/CustomExceptionHandler.java

@@ +1 @@
+package cz.zcu.fav.kiv.antipatterndetectionapp.v2.httpExceptions;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.ControllerAdvice;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.client.HttpClientErrorException;
+
+@ControllerAdvice
+public class CustomExceptionHandler {
+
+    @ExceptionHandler(HttpClientErrorException.Unauthorized.class)
+    public ResponseEntity<String> handleUnauthorizedException(HttpClientErrorException.Unauthorized ex) {
+        return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body(ex.getResponseBodyAsString());
+    }
+
+}

src/main/java/cz/zcu/fav/kiv/antipatterndetectionapp/v2/security/JwtAuthenticationFilter.java

@@ -1 +1 @@
 package cz.zcu.fav.kiv.antipatterndetectionapp.v2.security;
 
+import cz.zcu.fav.kiv.antipatterndetectionapp.v2.httpExceptions.CustomExceptionHandler;
 import cz.zcu.fav.kiv.antipatterndetectionapp.v2.service.OAuthService;
 import org.springframework.http.*;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
@@ -59 +60 @@
             }*/
         } catch (Exception e) {
             SecurityContextHolder.clearContext();
-            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
+            response.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
             response.getOutputStream().println("{\"error\" : \"Some other error related to jwt token!\"}");
             return;
         }
 
         chain.doFilter(request, response);
     }
+
+    @Override
+    protected boolean shouldNotFilter(HttpServletRequest request) throws ServletException {
+            String path = request.getRequestURI().substring(request.getContextPath().length());
+        return path.startsWith("/v2/user/");
+    }
 }
 

src/main/java/cz/zcu/fav/kiv/antipatterndetectionapp/v2/security/WebSecurityConfig.java

@@ -64 +64 @@
         httpSecurity
                 .csrf().disable()
                 .authorizeRequests()
-                .antMatchers("/v2/user/register", "/v2/user/login").permitAll()
+                .mvcMatchers("/v2/user/register", "/v2/user/login", "/v2/user/refresh", "/v2/user/logout").permitAll()
                 .anyRequest().authenticated()
-//                .and()
-//                .exceptionHandling()
-//                .authenticationEntryPoint(new OAuthServiceImpl())
                 .and()
                 .sessionManagement()
                 .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                 .and()
                 .addFilterBefore(new JwtAuthenticationFilter(new OAuthServiceImpl()), UsernamePasswordAuthenticationFilter.class);
-//        httpSecurity.addFilterAfter(new JwtAuthenticationFilter(new OAuthServiceImpl()), UsernamePasswordAuthenticationFilter.class);
-//        httpSecurity.addFilter(new JwtAuthenticationFilter(new OAuthServiceImpl()));
     }
 
 }

src/main/java/cz/zcu/fav/kiv/antipatterndetectionapp/v2/service/OAuthService.java

@@ -10 +10 @@
     public ResponseEntity<String> authenticate(String token);
     public ResponseEntity<String> loginUser(User user);
     public ResponseEntity<String> logoutUser(User user);
+
+    ResponseEntity<String> refreshToken(String token);
+
 }

src/main/java/cz/zcu/fav/kiv/antipatterndetectionapp/v2/service/OAuthServiceImpl.java

@@ -44 +44 @@
 //    @Value("${auth.realm.logout}")
     private String AUTH_URL_LOGOUT = "http://localhost:8081/logout";
 
+    private String AUTH_URL_REFRESH = "http://localhost:8081/refresh";
+
     /**
      *
      */
@@ -89 +91 @@
         return RequestBuilder.sendRequestResponse(AUTH_URL_LOGOUT, requestBody);
     }
 
+    @Override
+    public ResponseEntity<String> refreshToken(String token) {
+        return RequestBuilder.sendRequestResponse(AUTH_URL_REFRESH, token, true);
+    }
+
     @Override
     public UserDetails loadUserByUsername(String s) throws UsernameNotFoundException {
         final User user = this.userService.getUserByName(s);

src/main/java/cz/zcu/fav/kiv/antipatterndetectionapp/v2/utils/RequestBuilder.java

@@ -44 +44 @@
         return response;
     }
 
+    public static ResponseEntity<String> sendRequestResponse(String url, String token, boolean get) {
+        RestTemplate restTemplate = new RestTemplate();
+
+        HttpHeaders headers = new HttpHeaders();
+
+        headers.setContentType(MediaType.APPLICATION_JSON);
+        //headers.set("X-spade-request",spadeSignature);
+        headers.set(HttpHeaders.AUTHORIZATION, "Bearer " + token);
+
+        HttpEntity<String> entity = new HttpEntity<>(null, headers);
+        ResponseEntity<String> response = restTemplate.exchange(url, HttpMethod.GET, entity, String.class);
+        return response;
+    }
+
 }