Fikset SecurityConfig for UDIStub

navikt · Oct 27, 2023 · 1c86dd3 · 1c86dd3
1 parent b47cc18
commit 1c86dd3
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/apps/udi-stub/src/main/java/no/nav/udistub/config/SecurityConfig.java b/apps/udi-stub/src/main/java/no/nav/udistub/config/SecurityConfig.java
@@ -9,19 +9,23 @@
 import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
+import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
 
 @EnableWebSecurity
 @Configuration
 @Profile({ "prod", "dev" })
 public class SecurityConfig {
 
     @Bean
-    public SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception {
+    public SecurityFilterChain filterChain(HttpSecurity httpSecurity, HandlerMappingIntrospector introspector) throws Exception {
+
+        MvcRequestMatcher.Builder mvcMatcherBuilder = new MvcRequestMatcher.Builder(introspector);
 
         httpSecurity.sessionManagement(sessionConfig -> sessionConfig.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                 .csrf(AbstractHttpConfigurer::disable)
                 .authorizeHttpRequests(authorizeConfig -> authorizeConfig
-                        .requestMatchers("/api/**").fullyAuthenticated()
+                        .requestMatchers(mvcMatcherBuilder.pattern("/api/**")).fullyAuthenticated()
                         .anyRequest().permitAll())
                 .oauth2ResourceServer(oauth2RSConfig -> oauth2RSConfig.jwt(Customizer.withDefaults()));