KRYSTALM7 commented on code in PR #54:
URL:
https://github.com/apache/fineract-loan-origination/pull/54#discussion_r3699589862
##########
src/main/java/org/apache/fineract/los/config/SecurityConfig.java:
##########
@@ -19,48 +19,110 @@
package org.apache.fineract.los.config;
+import java.util.List;
+import org.apache.fineract.los.security.FineractAuthenticationProvider;
+import org.apache.fineract.los.security.JwtAuthFilter;
+import org.apache.fineract.los.security.JwtService;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
+import org.springframework.core.annotation.Order;
import
org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import
org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import
org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
+import
org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
-/**
- * Security configuration for the Loan Origination Service.
- *
- * <p>This service is a stateless REST API secured via the {@code
X-Fineract-Platform-TenantId}
- * header and Basic authentication. CSRF protection is intentionally disabled
because:
- *
- * <ul>
- * <li>The API is stateless — no session cookies are used
- * <li>All clients are server-side (Angular uses Authorization header, not
cookies)
- * <li>CSRF attacks require cookie-based session state which this service
does not maintain
- * </ul>
- *
- * <p>This follows the standard practice for REST APIs as documented in the
Spring Security
- * reference:
- *
https://docs.spring.io/spring-security/reference/features/exploits/csrf.html#csrf-when-to-use
- */
@Configuration
@EnableMethodSecurity
public class SecurityConfig {
+ /**
+ * Customer-facing chain (Order 1). Covers all customer and loan-application
endpoints.
+ * Authentication is handled via LOS-issued JWT tokens — credentials are
validated locally against
+ * the {@code customer_credentials} table; Fineract is never consulted for
customer login.
+ */
@Bean
- SecurityFilterChain securityFilterChain(final HttpSecurity http) throws
Exception {
+ @Order(1)
+ SecurityFilterChain jwtSecurityFilterChain(final HttpSecurity http, final
JwtService jwtService)
+ throws Exception {
+
+ http.securityMatcher("/api/v1/customer/**")
+ .cors(cors -> cors.configurationSource(corsConfigurationSource()))
+ .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
+ .addFilterBefore(new JwtAuthFilter(jwtService),
UsernamePasswordAuthenticationFilter.class)
+ .csrf(AbstractHttpConfigurer::disable)
Review Comment:
replaced the full CSRF disable with scoped ignoringRequestMatchers on both
security chains, same pattern used elsewhere in the file. Should resolve on
next checks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
