disabled ssl for now

JanisBe · Jun 3, 2024 · 38b5bd6 · 38b5bd6
1 parent a0f9890
commit 38b5bd6
Show file tree

Hide file tree

Showing 8 changed files with 60 additions and 27 deletions.
diff --git a/src/main/frontend/angular.json b/src/main/frontend/angular.json
@@ -23,7 +23,8 @@
           "builder": "@angular-devkit/build-angular:application",
           "options": {
             "outputPath": {
-              "base": "../resources/static"
+              "base": "../resources/static",
+              "browser": ""
             },
             "allowedCommonJsDependencies": [
               "ts-md5"
@@ -73,7 +74,8 @@
                   "replace": "src/environments/environment.ts",
                   "with": "src/environments/environment.prod.ts"
                 }
-              ]
+              ],
+              "deleteOutputPath": true
             },
             "development": {
               "optimization": false,

diff --git a/src/main/frontend/package-lock.json b/src/main/frontend/package-lock.json
diff --git a/src/main/frontend/package.json b/src/main/frontend/package.json
@@ -24,6 +24,7 @@
     "@fortawesome/fontawesome-free": "5.15.4",
     "@material/density": "^15.0.0-canary.a246a4439.0",
     "bootstrap": "^5.0.2",
+    "fs-extra": "^11.2.0",
     "ngx-gravatar": "^13.0.0",
     "rxjs": "~7.8.0",
     "tslib": "^2.3.0",
@@ -42,4 +43,4 @@
     "karma-jasmine-html-reporter": "~2.0.0",
     "typescript": "~5.4.5"
   }
-}
+}
diff --git a/src/main/frontend/src/environments/environment.ts b/src/main/frontend/src/environments/environment.ts
@@ -1,4 +1,4 @@
 export const environment = {
   production: false,
-  API_URL: 'https://localhost:8080/api'
+  API_URL: 'http://localhost:8080/api'
 }
diff --git a/src/main/java/pl/janis/komornik/config/SecurityConfig.java b/src/main/java/pl/janis/komornik/config/SecurityConfig.java
@@ -48,11 +48,10 @@ public SecurityConfig(@Lazy Filter jwtAuthFilter, @Lazy UserService userService)
 
     @Bean
     public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
-
         CookieCsrfTokenRepository cookieCsrfTokenRepository = new CookieCsrfTokenRepository();
         cookieCsrfTokenRepository.setCookieCustomizer(c -> c.secure(true).httpOnly(true).sameSite("none"));
         http.securityContext(context -> context.requireExplicitSave(false))
-                .requiresChannel(channel -> channel.anyRequest().requiresSecure())
+//                .requiresChannel(channel -> channel.anyRequest().requiresSecure())
                 .csrf(csrf -> csrf
                         .csrfTokenRepository(cookieCsrfTokenRepository)
                         .csrfTokenRequestHandler(new MyCsrfTokenRequestHandler())
@@ -86,11 +85,10 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti
                     logout.logoutSuccessHandler((request, response, authentication) -> response.setStatus(HttpServletResponse.SC_OK));
                 })
                 .headers(headers ->
-                        headers.xssProtection(
-                                xss -> xss.headerValue(XXssProtectionHeaderWriter.HeaderValue.ENABLED_MODE_BLOCK)
-                        ).contentSecurityPolicy(
-                                cps -> cps.policyDirectives("default-src 'none'; img-src * 'self' data: https:; font-src 'self' https:; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' http: https:; object-src 'none';  manifest-src 'self'")
-                        ))
+                        headers
+                                .xssProtection(xss -> xss.headerValue(XXssProtectionHeaderWriter.HeaderValue.ENABLED_MODE_BLOCK))
+                                .contentSecurityPolicy(cps -> cps.policyDirectives("default-src 'none'; img-src * 'self' data: https:; font-src 'self' https:; connect-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' http: https:; object-src 'none';  manifest-src 'self'"))
+                )
                 .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                 .authenticationProvider(authenticationProvider())
                 .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class)

diff --git a/src/main/java/pl/janis/komornik/rest/AuthenticationRestController.java b/src/main/java/pl/janis/komornik/rest/AuthenticationRestController.java
@@ -3,8 +3,6 @@
 import jakarta.servlet.http.Cookie;
 import jakarta.servlet.http.HttpServletResponse;
 import lombok.RequiredArgsConstructor;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
@@ -34,13 +32,12 @@
 public class AuthenticationRestController {
 
 
-    private static final Logger log = LoggerFactory.getLogger(AuthenticationRestController.class);
     private final UserService userDetailsService;
     private final JwtUtil jwtUtil;
     private final UserMapper userMapper;
     private final AuthenticationManager authenticationManager;
 
-    @Value("${server.ssl.enabled}")
+    @Value("${server.ssl.enabled:false}")
     private String isHttpsEnabled;
 
     @PostMapping("/auth/authenticate")

diff --git a/src/main/java/pl/janis/komornik/rest/BaseController.java b/src/main/java/pl/janis/komornik/rest/BaseController.java
@@ -2,12 +2,11 @@
 
 import org.springframework.boot.web.servlet.error.ErrorController;
 import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.RequestMapping;
 
 @Controller
 public class BaseController implements ErrorController {
-    @RequestMapping("")
-    public String gui() {
-        return "forward:/index.html";
-    }
+//    @RequestMapping("")
+//    public String gui() {
+//        return "forward:/index.html";
+//    }
 }
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
@@ -10,11 +10,7 @@ jwt.duration=1
 jwt.secret-key=ENC(cD/Zb7b/kxjvWeMmk1ka+AUkCZOeKfx+UJvxQnC6eGv16N4hNjZhj8gAJ5uluJZ4NlrFY+uQzSA0+1OKDa9AZaSpuKOujChmAoUhpnK93iJ4Bh2FGoQYvgXG0M/QkaAV5XQetJeHX1FZZV/IPaHIzWiBps3mc/rf72NdZaHmyrKQhVcSP6NKY5c4a/o94auV)
 spring.config.import=classpath:application-secrets.properties
 server.http.port=8090
-server.ssl.key-store-type=PKCS12
-server.ssl.key-store=classpath:komornik.data
-server.ssl.key-store-password=sslDOkomornik
-server.ssl.key-alias=komornik
-server.ssl.enabled=true
+server.ssl.enabled=false
 server.servlet.session.cookie.same-site=none
 server.servlet.session.cookie.secure=true
 server.servlet.session.cookie.http-only=true