Merge pull request #10639 from smatvienko-tb/feature/security-configuration-deprecation-replacement

SecurityConfiguration: deprecated authorizeRequests replaced with authorizeHttpRequests

application/src/main/java/org/thingsboard/server/config/TbRuleEngineSecurityConfiguration.java

@@ -40,9 +40,9 @@ public class TbRuleEngineSecurityConfiguration {
                         .frameOptions(config -> {}).disable())
                 .cors(cors -> {})
                 .csrf(AbstractHttpConfigurer::disable)
-                .authorizeRequests()
-                .requestMatchers("/actuator/prometheus").permitAll()
-                .anyRequest().authenticated();
+                .authorizeHttpRequests(config -> config
+                        .requestMatchers("/actuator/prometheus").permitAll()
+                        .anyRequest().authenticated());
         return http.build();
     }
 }

application/src/main/java/org/thingsboard/server/config/ThingsboardSecurityConfiguration.java

@@ -209,7 +209,7 @@ public class ThingsboardSecurityConfiguration {
                 .csrf(AbstractHttpConfigurer::disable)
                 .exceptionHandling(config -> {})
                 .sessionManagement(config -> config.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
-                .authorizeRequests(config -> config
+                .authorizeHttpRequests(config -> config
                         .requestMatchers(WEBJARS_ENTRY_POINT).permitAll() // Webjars
                         .requestMatchers(DEVICE_API_ENTRY_POINT).permitAll() // Device HTTP Transport API
                         .requestMatchers(FORM_BASED_LOGIN_ENTRY_POINT).permitAll() // Login end-point
@@ -217,10 +217,11 @@ public class ThingsboardSecurityConfiguration {
                         .requestMatchers(TOKEN_REFRESH_ENTRY_POINT).permitAll() // Token refresh end-point
                         .requestMatchers(MAIL_OAUTH2_PROCESSING_ENTRY_POINT).permitAll() // Mail oauth2 code processing url
                         .requestMatchers(DEVICE_CONNECTIVITY_CERTIFICATE_DOWNLOAD_ENTRY_POINT).permitAll() // Device connectivity certificate (public)
-                        .requestMatchers(NON_TOKEN_BASED_AUTH_ENTRY_POINTS).permitAll()) // static resources, user activation and password reset end-points
-                .authorizeRequests(config -> config
+                        .requestMatchers(NON_TOKEN_BASED_AUTH_ENTRY_POINTS).permitAll() // static resources, user activation and password reset end-points
                         .requestMatchers(WS_ENTRY_POINT).permitAll() // Protected WebSocket API End-points
                         .requestMatchers(TOKEN_BASED_AUTH_ENTRY_POINT).authenticated()) // Protected API End-points
+                .formLogin(form -> form
+                        .loginPage("/login").permitAll())
                 .exceptionHandling(config -> config.accessDeniedHandler(restAccessDeniedHandler))
                 .addFilterBefore(buildRestLoginProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
                 .addFilterBefore(buildRestPublicLoginProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
@@ -243,7 +244,7 @@ public class ThingsboardSecurityConfiguration {
     @Bean
     @ConditionalOnMissingBean(CorsFilter.class)
     public CorsFilter corsFilter(@Autowired MvcCorsProperties mvcCorsProperties) {
-        if (mvcCorsProperties.getMappings().size() == 0) {
+        if (mvcCorsProperties.getMappings().isEmpty()) {
             return new CorsFilter(new UrlBasedCorsConfigurationSource());
         } else {
             UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();