@ Override protected void configure ( HttpSecurity http ) throws Exception { // Gets a secure random key for the remember be token key SecureRandom random = new SecureRandom ( ) ; byte [ ] randomBytes = new byte [ 64 ] ; random . nextBytes ( randomBytes ) ; String rememberBeKey = new String ( Hex . encode ( randomBytes ) ) ; // @formatter:off http . antMatcher ( "/**" ) // Only BASIC authentication . httpBasic ( ) . authenticationEntryPoint ( apiBasicAuthenticationEntryPoint ) . realmName ( "ontrack" ) . and ( ) // Logout set-up . logout ( ) . logoutUrl ( "/user/logout" ) . logoutSuccessUrl ( "/user/logged-out" ) . addLogoutHandler ( basicRememberMeUserDetailsService ( ) ) . and ( ) // FIXME CSRF protection for a stateless API? //.csrf().requireCsrfProtectionMatcher(new CSRFRequestMatcher()).and() . csrf ( ) . disable ( ) // Allows all at Web level . authorizeRequests ( ) . antMatchers ( "/**" ) . permitAll ( ) // Remember be authentication token . and ( ) . rememberMe ( ) . rememberMeServices ( rememberMeServices ( rememberBeKey ) ) . key ( rememberBeKey ) . tokenValiditySeconds ( 604800 ) // Cache enabled . and ( ) . headers ( ) . cacheControl ( ) . disable ( ) ; // @formatter:on }
By default all queries are accessible anonymously . Security is enforced at service level .