From 909e7a9ecd442d344802a8019a0dcf11f41f5daa Mon Sep 17 00:00:00 2001 From: tschiman Date: Sat, 29 Apr 2017 21:10:49 -0600 Subject: [PATCH] BAEL-797 fixing security settings --- .../spring/cloud/bootstrap/gateway/SecurityConfig.java | 5 +---- .../baeldung/spring/cloud/bootstrap/gateway/LiveTest.java | 7 ++++--- 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/spring-cloud/spring-cloud-bootstrap/gateway/src/main/java/com/baeldung/spring/cloud/bootstrap/gateway/SecurityConfig.java b/spring-cloud/spring-cloud-bootstrap/gateway/src/main/java/com/baeldung/spring/cloud/bootstrap/gateway/SecurityConfig.java index 8d76e0acc9..752382aa4c 100644 --- a/spring-cloud/spring-cloud-bootstrap/gateway/src/main/java/com/baeldung/spring/cloud/bootstrap/gateway/SecurityConfig.java +++ b/spring-cloud/spring-cloud-bootstrap/gateway/src/main/java/com/baeldung/spring/cloud/bootstrap/gateway/SecurityConfig.java @@ -29,11 +29,8 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter { .httpBasic() .and() .authorizeRequests() - .antMatchers("/*.js","/*.html","/*.ico", "/*").permitAll() - .antMatchers("/book-service/books").permitAll() - .antMatchers("/zipkin/**").permitAll() .antMatchers("/eureka/**").hasRole("ADMIN") - .anyRequest().authenticated() + .anyRequest().permitAll() .and() .logout() .and() diff --git a/spring-cloud/spring-cloud-bootstrap/gateway/src/test/java/com/baeldung/spring/cloud/bootstrap/gateway/LiveTest.java b/spring-cloud/spring-cloud-bootstrap/gateway/src/test/java/com/baeldung/spring/cloud/bootstrap/gateway/LiveTest.java index c79fb317fe..ee040c6c30 100644 --- a/spring-cloud/spring-cloud-bootstrap/gateway/src/test/java/com/baeldung/spring/cloud/bootstrap/gateway/LiveTest.java +++ b/spring-cloud/spring-cloud-bootstrap/gateway/src/test/java/com/baeldung/spring/cloud/bootstrap/gateway/LiveTest.java @@ -35,8 +35,9 @@ public class LiveTest { @Test public void whenAccessProtectedResourceWithoutLogin_thenRedirectToLogin() { - final Response response = RestAssured.get(ROOT_URI + "/book-service/books/1"); - Assert.assertEquals(HttpStatus.UNAUTHORIZED.value(), response.getStatusCode()); + final Response response = RestAssured.get(ROOT_URI + "/rating-service/ratings?bookId=1"); + Assert.assertEquals(HttpStatus.FORBIDDEN.value(), response.getStatusCode()); + Assert.assertNotNull(response.getBody()); } @Test @@ -46,7 +47,7 @@ public class LiveTest { .auth().preemptive().basic("user", "password") .header("X-XSRF-TOKEN", sessionData.getCsrf()) .filter(sessionFilter) - .get(ROOT_URI + "/book-service/books/1"); + .get(ROOT_URI + "/rating-service/ratings?bookId=1"); Assert.assertEquals(HttpStatus.OK.value(), response.getStatusCode()); Assert.assertNotNull(response.getBody()); }