From 3bfe5d94da692fd4d388c29903f7d50117904950 Mon Sep 17 00:00:00 2001
From: Vitaly Takmazov
Date: Wed, 29 Mar 2017 14:36:47 +0300
Subject: juick-www: fix hash-based auth

---
 .../juick/www/configuration/WebSecurityConfig.java | 33 +++++++++++++++++-----
 1 file changed, 26 insertions(+), 7 deletions(-)

(limited to 'juick-www/src/main/java/com')

diff --git a/juick-www/src/main/java/com/juick/www/configuration/WebSecurityConfig.java b/juick-www/src/main/java/com/juick/www/configuration/WebSecurityConfig.java
index 9d603da8..2b8dc292 100644
--- a/juick-www/src/main/java/com/juick/www/configuration/WebSecurityConfig.java
+++ b/juick-www/src/main/java/com/juick/www/configuration/WebSecurityConfig.java
@@ -3,12 +3,15 @@ package com.juick.www.configuration;
 import com.juick.server.security.entities.JuickUser;
 import com.juick.service.UserService;
 import com.juick.service.security.JuickUserDetailsService;
+import com.juick.service.security.deprecated.RequestParamHashRememberMeServices;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.annotation.Bean;
-import org.springframework.core.env.Environment;
+import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.web.authentication.RememberMeServices;
 
 import javax.annotation.Resource;
 
@@ -17,8 +20,10 @@ import javax.annotation.Resource;
  */
 @EnableWebSecurity
 public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
-    @Resource
-    private Environment env;
+    @Value("${auth_remember_me_key}")
+    private String rememberMeKey;
+    @Value("${web_domain:juick.com}")
+    private String webDomain;
     @Resource
     private UserService userService;
 
@@ -54,10 +59,24 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
                 .tokenValiditySeconds(6 * 30 * 24 * 3600)
                 .alwaysRemember(true)
                 //.useSecureCookie(true) // TODO Enable if https is supports
-                .rememberMeCookieDomain(env.getProperty("web_domain", "juick.com"))
+                .rememberMeCookieDomain(webDomain)
                 .userDetailsService(userDetailsServiceBean())
-                .key(env.getProperty("auth_remember_me_key"))
-                .and()
-                .csrf().disable();
+                .rememberMeServices(rememberMeServices())
+                .key(rememberMeKey)
+                .and().authenticationProvider(authenticationProvider())
+                .headers().defaultsDisabled().cacheControl();
+    }
+    @Bean
+    public DaoAuthenticationProvider authenticationProvider() {
+        DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
+
+        authenticationProvider.setUserDetailsService(userDetailsService());
+
+        return authenticationProvider;
+    }
+
+    @Bean
+    public RememberMeServices rememberMeServices() throws Exception {
+        return new RequestParamHashRememberMeServices(rememberMeKey, userService);
     }
 }
-- 
cgit v1.2.3