Browse Source

Merge pull request #6485 from smatvienko-tb/web-security-ignore-replaced-with-permit-all

[3.4] You are asking Spring Security to ignore Ant [pattern='/*.js']. This is not recommended -- please use permitAll via HttpSecurity#authorizeHttpRequests instead.
pull/6519/head
Andrew Shvayka 4 years ago
committed by GitHub
parent
commit
f49735b6ca
No known key found for this signature in database GPG Key ID: 4AEE18F83AFDEB23
  1. 10
      application/src/main/java/org/thingsboard/server/config/ThingsboardSecurityConfiguration.java

10
application/src/main/java/org/thingsboard/server/config/ThingsboardSecurityConfiguration.java

@ -176,16 +176,16 @@ public class ThingsboardSecurityConfiguration extends WebSecurityConfigurerAdapt
return new BCryptPasswordEncoder();
}
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("/*.js","/*.css","/*.ico","/assets/**","/static/**");
}
@Autowired
private OAuth2AuthorizationRequestResolver oAuth2AuthorizationRequestResolver;
@Override
protected void configure(HttpSecurity http) throws Exception {
http.authorizeHttpRequests((authorizeHttpRequests) ->
authorizeHttpRequests
.antMatchers("/*.js","/*.css","/*.ico","/assets/**","/static/**")
.permitAll()
);
http.headers().cacheControl().and().frameOptions().disable()
.and()
.cors()

Loading…
Cancel
Save