From 5b734c863ee40bec886e855e2a91c81e81197a23 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Fri, 22 May 2026 17:12:11 +0000 Subject: [PATCH 1/2] fix(security): add scoped cors for local web dev origins MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: Diêgo Ferreira --- .../ecommerce/config/SecurityConfig.java | 30 ++++++++++++++++++- 1 file changed, 29 insertions(+), 1 deletion(-) diff --git a/api/src/main/java/com/orderflow/ecommerce/config/SecurityConfig.java b/api/src/main/java/com/orderflow/ecommerce/config/SecurityConfig.java index 0e9ff97..0da2594 100644 --- a/api/src/main/java/com/orderflow/ecommerce/config/SecurityConfig.java +++ b/api/src/main/java/com/orderflow/ecommerce/config/SecurityConfig.java @@ -9,6 +9,11 @@ import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.web.SecurityFilterChain; +import org.springframework.web.cors.CorsConfiguration; +import org.springframework.web.cors.CorsConfigurationSource; +import org.springframework.web.cors.UrlBasedCorsConfigurationSource; + +import java.util.List; @Configuration @EnableWebSecurity @@ -18,6 +23,7 @@ public class SecurityConfig { public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { http .csrf(AbstractHttpConfigurer::disable) // Desabilita CSRF (comum em APIs REST) + .cors(cors -> cors.configurationSource(corsConfigurationSource())) .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) // API sem estado .authorizeHttpRequests(auth -> auth .anyRequest().permitAll() // Por enquanto, libera tudo para você não se travar @@ -25,8 +31,30 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti return http.build(); } + + /** + * Origens do front local e do compose: Vite (5173) e nginx da web (4173). + * Evita {@code allowedOriginPatterns("*")} com {@code allowCredentials(true)}, combinação inválida na especificação CORS. + */ + @Bean + public CorsConfigurationSource corsConfigurationSource() { + CorsConfiguration configuration = new CorsConfiguration(); + configuration.setAllowedOrigins(List.of( + "http://localhost:5173", + "http://127.0.0.1:5173", + "http://localhost:4173", + "http://127.0.0.1:4173" + )); + configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS")); + configuration.setAllowedHeaders(List.of("*")); + configuration.setAllowCredentials(false); + UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource(); + source.registerCorsConfiguration("/**", configuration); + return source; + } + @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } -} \ No newline at end of file +} From c60479bedb1389773923b12486d315836dc543ce Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Di=C3=AAgo=20de=20Barros?= Date: Sun, 31 May 2026 09:04:13 -0300 Subject: [PATCH 2/2] feat(security): enhance security configuration with refined request authorization and CORS settings --- .../ecommerce/config/SecurityConfig.java | 33 +++++++++++++------ 1 file changed, 23 insertions(+), 10 deletions(-) diff --git a/api/src/main/java/com/orderflow/ecommerce/config/SecurityConfig.java b/api/src/main/java/com/orderflow/ecommerce/config/SecurityConfig.java index 0da2594..66e183a 100644 --- a/api/src/main/java/com/orderflow/ecommerce/config/SecurityConfig.java +++ b/api/src/main/java/com/orderflow/ecommerce/config/SecurityConfig.java @@ -1,7 +1,11 @@ package com.orderflow.ecommerce.config; +import java.util.List; + import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.http.HttpMethod; +import org.springframework.http.HttpStatus; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; @@ -9,12 +13,11 @@ import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.web.SecurityFilterChain; +import org.springframework.security.web.authentication.HttpStatusEntryPoint; import org.springframework.web.cors.CorsConfiguration; import org.springframework.web.cors.CorsConfigurationSource; import org.springframework.web.cors.UrlBasedCorsConfigurationSource; -import java.util.List; - @Configuration @EnableWebSecurity public class SecurityConfig { @@ -22,20 +25,30 @@ public class SecurityConfig { @Bean public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { http - .csrf(AbstractHttpConfigurer::disable) // Desabilita CSRF (comum em APIs REST) + .csrf(AbstractHttpConfigurer::disable) .cors(cors -> cors.configurationSource(corsConfigurationSource())) - .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) // API sem estado + .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) + .httpBasic(AbstractHttpConfigurer::disable) + .formLogin(AbstractHttpConfigurer::disable) + .exceptionHandling(ex -> ex.authenticationEntryPoint( + new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))) .authorizeHttpRequests(auth -> auth - .anyRequest().permitAll() // Por enquanto, libera tudo para você não se travar + .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll() + .requestMatchers( + "/v3/api-docs/**", + "/swagger-ui/**", + "/swagger-ui.html" + ).permitAll() + .requestMatchers("/test/**").permitAll() + .requestMatchers("/auth/**").permitAll() + .requestMatchers(HttpMethod.GET, "/products/**", "/categories/**").permitAll() + .requestMatchers("/products/**", "/categories/**").authenticated() + .anyRequest().authenticated() ); - +// return http.build(); } - /** - * Origens do front local e do compose: Vite (5173) e nginx da web (4173). - * Evita {@code allowedOriginPatterns("*")} com {@code allowCredentials(true)}, combinação inválida na especificação CORS. - */ @Bean public CorsConfigurationSource corsConfigurationSource() { CorsConfiguration configuration = new CorsConfiguration();