joungmin/vpd-permission-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix #547: secure VM deployment behind HTTPS proxy

Browse Source
This commit is contained in:
devmrko
2026-06-28 23:03:32 +09:00
parent e63b3af653
commit 8dc77f87ab
12 changed files with 818 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/main/java/com/cloudhandson/vpdbackoffice/config/BackofficeProperties.java
View File

@@ -11,7 +11,7 @@ public record BackofficeProperties(
Ai ai
) {
public record Security(String adminUser, String adminPassword) {
public record Security(String adminUser, String adminPassword, boolean requireHttps) {
}
public record Token(int maxDays) {

12
src/main/java/com/cloudhandson/vpdbackoffice/config/SecurityConfig.java
View File

@@ -14,9 +14,19 @@ import org.springframework.security.web.SecurityFilterChain;
public class SecurityConfig {
@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
SecurityFilterChain securityFilterChain(
HttpSecurity http,
BackofficeProperties properties
) throws Exception {
if (properties.security().requireHttps()) {
http.requiresChannel(channel -> channel.anyRequest().requiresSecure());
}
return http
.csrf(csrf -> csrf.ignoringRequestMatchers("/mcp/messages", "/mcp/*/messages"))
.headers(headers -> headers.httpStrictTransportSecurity(hsts -> hsts
.includeSubDomains(true)
.maxAgeInSeconds(31_536_000)))
.authorizeHttpRequests(auth -> auth
.requestMatchers("/css/**", "/js/**", "/webjars/**").permitAll()
.anyRequest().authenticated())