Merge remote-tracking branch 'airsonic/pr/951'

master
Andrew DeMaria 6 years ago
commit 4b2cf99adf
No known key found for this signature in database
GPG Key ID: 0A3F5E91F8364EDF
  1. 9
      airsonic-main/src/main/java/org/airsonic/player/security/GlobalSecurityConfig.java

@ -22,6 +22,8 @@ import org.springframework.security.web.authentication.UsernamePasswordAuthentic
import org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter; import org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher; import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import java.security.SecureRandom;
@Configuration @Configuration
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER) @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true) @EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true)
@ -69,6 +71,11 @@ public class GlobalSecurityConfig extends GlobalAuthenticationConfigurerAdapter
auth.authenticationProvider(new JWTAuthenticationProvider(jwtKey)); auth.authenticationProvider(new JWTAuthenticationProvider(jwtKey));
} }
private static String generateRememberMeKey() {
byte[] array = new byte[32];
new SecureRandom().nextBytes(array);
return new String(array);
}
@Configuration @Configuration
@Order(1) @Order(1)
@ -162,7 +169,7 @@ public class GlobalSecurityConfig extends GlobalAuthenticationConfigurerAdapter
// see http://docs.spring.io/spring-security/site/docs/3.2.4.RELEASE/reference/htmlsingle/#csrf-logout // see http://docs.spring.io/spring-security/site/docs/3.2.4.RELEASE/reference/htmlsingle/#csrf-logout
.and().logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout", "GET")).logoutSuccessUrl( .and().logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout", "GET")).logoutSuccessUrl(
"/login?logout") "/login?logout")
.and().rememberMe().key("airsonic"); .and().rememberMe().key(generateRememberMeKey());
} }
} }

Loading…
Cancel
Save