ambiser
/
openvidu
mirror of https://github.com/OpenVidu/openvidu.git
8
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

openvidu-server: HTTP REST security rules updated

pull/88/merge
pabloFuente 2018-07-04 11:24:32 +02:00
parent c97a29fd50
commit 5844ddcd5f
1 changed files with 13 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
openvidu-server/src/main/java/io/openvidu/server/config/SecurityConfig.java
View File

@ -37,18 +37,25 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
// Security for API REST
ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry conf = http.cors().and()
.csrf().disable().authorizeRequests().antMatchers(HttpMethod.POST, "/api/sessions").authenticated()
.antMatchers(HttpMethod.POST, "/api/sessions/**").authenticated()
.csrf().disable().authorizeRequests()
// /api/sessions
.antMatchers(HttpMethod.GET, "/api/sessions").authenticated()
.antMatchers(HttpMethod.GET, "/api/sessions/**").authenticated()
.antMatchers(HttpMethod.POST, "/api/sessions").authenticated()
.antMatchers(HttpMethod.POST, "/api/sessions/**").authenticated()
// /api/tokens
.antMatchers(HttpMethod.POST, "/api/tokens").authenticated()
.antMatchers(HttpMethod.POST, "/api/recordings/start").authenticated()
.antMatchers(HttpMethod.POST, "/api/recordings/stop").authenticated()
// /api/recordings
.antMatchers(HttpMethod.GET, "/api/recordings").authenticated()
.antMatchers(HttpMethod.GET, "/api/recordings/**").authenticated()
.antMatchers(HttpMethod.POST, "/api/recordings/start").authenticated()
.antMatchers(HttpMethod.POST, "/api/recordings/stop").authenticated()
.antMatchers(HttpMethod.DELETE, "/api/recordings/**").authenticated()
.antMatchers(HttpMethod.GET, "/config/openvidu-publicurl").anonymous()
.antMatchers(HttpMethod.GET, "/config/**").authenticated();
// /api/config
.antMatchers(HttpMethod.GET, "/config/openvidu-publicurl").permitAll()
.antMatchers(HttpMethod.GET, "/config/**").authenticated()
// Dashboard
.antMatchers("/").authenticated();
// Security for layouts
conf.antMatchers("/layouts/*").authenticated();