Spring Boot – Configuring the Security Filter Chain

// Spring Security 5 and earlier. Removed. Does not compile.
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/api/public/**").permitAll()
                .anyRequest().authenticated()
            .and()
                .formLogin();
    }
}

/**
 * <p>This is Spring Security 7's lambda DSL — version 7 removed the older chained-setter style
 * entirely, so examples written against Spring Security 5 will not compile here.
 *
 * <p>Rules are evaluated IN ORDER, first match wins. That is why the specific patterns
 * ({@code /api/orders/mine}) come before the general ones ({@code /api/orders/**}).
 */
@Configuration
@EnableWebSecurity
@EnableMethodSecurity
@RequiredArgsConstructor
public class SecurityConfig {

    private final JwtAuthenticationFilter jwtAuthenticationFilter;
    private final PizzaProperties properties;

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.cors(Customizer.withDefaults())
                .csrf(csrf -> csrf.disable())
                .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers("/api/auth/register", "/api/auth/login").permitAll()
                        .requestMatchers("/api/admin/**").hasRole("ADMIN")
                        .anyRequest().authenticated())
                .addFilterBefore(
                        jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }
}

// WRONG — /api/orders/mine is matched by the general rule first and becomes public.
.requestMatchers(HttpMethod.GET, "/api/orders/**").permitAll()
.requestMatchers(HttpMethod.GET, "/api/orders/mine").authenticated()

// RIGHT — specific before general.
.requestMatchers(HttpMethod.GET, "/api/orders/mine").authenticated()
.requestMatchers(HttpMethod.GET, "/api/orders/**").permitAll()

// Default deny. Anything not listed above needs authentication, so a new
// endpoint is closed until someone deliberately opens it.
.anyRequest()
.authenticated()

// ---- documentation -------------------------------------------------
.requestMatchers("/v3/api-docs/**", "/swagger-ui/**", "/swagger-ui.html")
.permitAll()

// ---- the caller's own profile --------------------------------------
// /api/me/** always means "the signed-in caller", so there is no id in
// the path that could be swapped for someone else's.
.requestMatchers("/api/me/**")
.authenticated()

// ---- Stripe callbacks ----------------------------------------------
// Stripe cannot present a JWT. This endpoint is protected instead by
// verifying the Stripe-Signature header — see StripeWebhookController.
.requestMatchers("/api/webhooks/**")
.permitAll()

// ---- public menu ---------------------------------------------------
.requestMatchers(HttpMethod.GET, "/api/products/**", "/api/toppings/**", "/api/crusts/**")
.permitAll()

// ---- cart ----------------------------------------------------------
// Public, like guest checkout — you do not need an account to fill a
// basket. The cart's unguessable UUID is what protects it.
.requestMatchers("/api/carts", "/api/carts/**")
.permitAll()

// ---- orders --------------------------------------------------------
// Specific first: order history needs a real account.
.requestMatchers(HttpMethod.GET, "/api/orders/mine")
.authenticated()
// Placing an order must NOT require a login — this is guest checkout.
.requestMatchers(HttpMethod.POST, "/api/orders")
.permitAll()

// ---- admin ---------------------------------------------------------
.requestMatchers("/api/admin/**")
.hasRole("ADMIN")

// Browsing the menu is public, and so is searching it. The reindex endpoint
// below it is NOT — it falls through to /api/search/** ... which does not
// exist, so it lands on anyRequest().authenticated(). Stated explicitly
// instead, because "protected by accident" is not protected.
.requestMatchers(HttpMethod.GET, "/api/search/products").permitAll()
.requestMatchers(HttpMethod.POST, "/api/search/reindex").hasRole("ADMIN")

// Safe to disable ONLY because this API is stateless and token-based: there is no
// session cookie for a cross-site request to ride on. Never do this for a
// cookie-authenticated app.
.csrf(csrf -> csrf.disable())

.sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))

// Runs before the username/password filter so a valid token authenticates the
// request before anything tries to challenge it.
.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)

.exceptionHandling(ex -> ex
        .authenticationEntryPoint((request, response, authException) -> {
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
            response.setContentType(MediaType.APPLICATION_JSON_VALUE);
            response.getWriter().write(
                    "{\"message\":\"Authentication required\"}");
        })
        .accessDeniedHandler((request, response, deniedException) -> {
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response.setContentType(MediaType.APPLICATION_JSON_VALUE);
            response.getWriter().write(
                    "{\"message\":\"You do not have permission to do that\"}");
        }))

logging.level.org.springframework.security=DEBUG