<commit_before>package de.ppi.samples.fuwesta.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import de.ppi.samples.fuwesta.frontend.URL;

/**
 * Config for secure the application.
 * 
 */
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    /**
     * Config the {@link AuthenticationManagerBuilder}.
     * 
     * @param auth the builder
     * @throws Exception if something goes wrong
     */
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth)
            throws Exception {
        //J-
        auth.inMemoryAuthentication().
            withUser("user").password("<PASSWORD>").roles("USER").and().
            withUser("post").password("<PASSWORD>").roles("POST").and().
            withUser("tag").password("<PASSWORD>").roles("TAG").and().
            withUser("admin").password("<PASSWORD>").roles("ADMIN");
        //J+
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //J-
        http.authorizeRequests().antMatchers(URL.LOGIN, "/logout").permitAll().and().
            authorizeRequests().antMatchers("/tag/**").hasAnyRole("TAG", "ADMIN").and().
            authorizeRequests().antMatchers("/user/**").hasAnyRole("USER", "ADMIN").and().
            authorizeRequests().antMatchers("/post/**").hasAnyRole("POST", "ADMIN").and().
            authorizeRequests().antMatchers("/").permitAll().and().
            authorizeRequests().anyRequest().denyAll().and().
            formLogin().loginPage(URL.LOGIN).and().
            rememberMe().key("PPI-SECRET");
        //J+
    }

    @Override
    public void configure(final WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/resources/**");
    }
}<commit_msg>Disable CSRF-Protection. Otherwise the login doesn't work any more. Obviously this is for security a bad decision, but I think if you really want to protect your app, you must think more about security.<commit_after>package de.ppi.samples.fuwesta.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import de.ppi.samples.fuwesta.frontend.URL;

/**
 * Config for secure the application.
 * 
 */
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    /**
     * Config the {@link AuthenticationManagerBuilder}.
     * 
     * @param auth the builder
     * @throws Exception if something goes wrong
     */
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth)
            throws Exception {
        //J-
        auth.inMemoryAuthentication().
            withUser("user").password("<PASSWORD>").roles("USER").and().
            withUser("post").password("<PASSWORD>").roles("POST").and().
            withUser("tag").password("<PASSWORD>").roles("TAG").and().
            withUser("admin").password("<PASSWORD>").roles("ADMIN");
        //J+
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //J-
        http.authorizeRequests().antMatchers(URL.LOGIN, "/logout").permitAll().and().
            authorizeRequests().antMatchers("/tag/**").hasAnyRole("TAG", "ADMIN").and().
            authorizeRequests().antMatchers("/user/**").hasAnyRole("USER", "ADMIN").and().
            authorizeRequests().antMatchers("/post/**").hasAnyRole("POST", "ADMIN").and().
            authorizeRequests().antMatchers("/").permitAll().and().
            authorizeRequests().anyRequest().denyAll().and().
            formLogin().loginPage(URL.LOGIN).and().
            rememberMe().key("PPI-SECRET").and().csrf().disable();
        //J+
    }

    @Override
    public void configure(final WebSecurity web) throws Exception {
        web.ignoring().antMatchers("/resources/**");
    }
}
{'fraction_non_alphanumeric': 0.14585908529048208, 'fraction_numerical': 0.0, 'mean_word_length': 3.575871819038643, 'pattern_counts': {'":': 0, '<': 11, '<?xml version=': 0, '>': 11, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2407724', 'n_tokens_mistral': 1256, 'n_tokens_neox': 1263, 'n_words': 209}