@Override protected void configure(HttpSecurity http) throws Exception{
http.cors().and().csrf().disable().headers().frameOptions().disable().and().authorizeRequests().antMatchers("/api/login").permitAll()
.antMatchers("api/testUser").permitAll()
.antMatchers("/api/testPost").permitAll()
.antMatchers("/api/register").permitAll()
.antMatchers("/api/employees").hasRole("ADMIN")
.antMatchers("/api/employees/*").hasAnyRole("ADMIN", "USER")
.antMatchers("/api/students/all").permitAll()
.anyRequest().authenticated()
.and()
.apply(new JwtConfigurer(jwtTokenProvider));
}
@Bean
public WebMvcConfigurer corsConfigurer() {
return new WebMvcConfigurer() {
@Override public void addCorsMappings(CorsRegistry registry) {
registry.addMapping("/**")
.allowedOriginPatterns("*")
.allowedMethods("*")
.exposedHeaders("Authorization, Link, X-Total-Count")
.allowCredentials(true).maxAge(3600);
}
};
}