Spring Security Filter Chain

1
@Configuration
2
@EnableMethodSecurity
3
class SecurityConfig {
4

5
    @Bean
6
    @Order(1)
7
    SecurityFilterChain mobileApi(HttpSecurity http, JwtAuthenticationConverter jwtConverter,
8
                                  RequestIdFilter requestId) throws Exception {
9
        return http
10
                .securityMatcher("/api/**")                   // this chain only sees /api/**
11
                .authorizeHttpRequests(auth -> auth
12
                        .requestMatchers(HttpMethod.GET, "/api/fx-rates/**").permitAll()   // public rate board
13
                        .requestMatchers("/api/ops/**").hasRole("OPERATIONS")
14
                        .anyRequest().authenticated())
15
                .oauth2ResourceServer(oauth -> oauth.jwt(jwt -> jwt.jwtAuthenticationConverter(jwtConverter)))
16
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
17
                // No cookies are used on this chain, so there is nothing for CSRF to protect.
18
                .csrf(csrf -> csrf.disable())
19
                .addFilterBefore(requestId, BearerTokenAuthenticationFilter.class)
20
                .build();
21
    }
22

23
    @Bean
24
    @Order(2)
25
    SecurityFilterChain branchPanel(HttpSecurity http) throws Exception {
26
        return http
27
                .authorizeHttpRequests(auth -> auth
28
                        .requestMatchers("/login", "/assets/**").permitAll()
29
                        .requestMatchers("/panel/limits/**").hasRole("BRANCH_MANAGER")
30
                        .anyRequest().hasRole("BRANCH_OFFICER"))
31
                .formLogin(Customizer.withDefaults())   // session cookie: CSRF stays ON here
32
                .sessionManagement(session -> session.maximumSessions(1))   // one desk, one session
33
                .build();
34
    }
35
}

1
@Configuration
2
class JwtRolesConfig {
3

4
    // Token: { "sub": "C-100042", "roles": ["CUSTOMER"] }  ->  ROLE_CUSTOMER
5
    @Bean
6
    JwtAuthenticationConverter jwtAuthenticationConverter() {
7
        var authorities = new JwtGrantedAuthoritiesConverter();
8
        authorities.setAuthoritiesClaimName("roles");
9
        authorities.setAuthorityPrefix("ROLE_");
10

11
        var converter = new JwtAuthenticationConverter();
12
        converter.setJwtGrantedAuthoritiesConverter(authorities);
13
        return converter;
14
    }
15
}

1
@Service
2
class AccountQueries {
3

4
    private final AccountRepository accounts;
5
    private final TransactionHistory history;
6

7
    AccountQueries(AccountRepository accounts, TransactionHistory history) {
8
        this.accounts = accounts;
9
        this.history = history;
10
    }
11

12
    // The URL rule only says "authenticated". Whether this IBAN belongs to the caller
13
    // is decided here: guessing another customer's IBAN must not show their movements.
14
    @PreAuthorize("hasRole('OPERATIONS') or @accountOwnership.owns(authentication.name, #iban)")
15
    public List<MovementView> movements(String iban, YearMonth month) {
16
        return history.of(iban, month);
17
    }
18
}
19

20
@Component("accountOwnership")
21
class AccountOwnership {
22

23
    private final AccountRepository accounts;
24

25
    AccountOwnership(AccountRepository accounts) {
26
        this.accounts = accounts;
27
    }
28

29
    public boolean owns(String customerNo, String iban) {
30
        return accounts.existsByIbanAndCustomerNo(iban, customerNo);
31
    }
32
}

1
@Component
2
class RequestIdFilter extends OncePerRequestFilter {
3

4
    @Override
5
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
6
                                    FilterChain chain) throws ServletException, IOException {
7
        String id = Optional.ofNullable(request.getHeader("X-Request-Id"))
8
                .orElseGet(() -> UUID.randomUUID().toString());
9
        MDC.put("requestId", id);
10
        response.setHeader("X-Request-Id", id);
11
        try {
12
            chain.doFilter(request, response);
13
        } finally {
14
            MDC.remove("requestId");
15
        }
16
    }
17
}
18

19
// Registered as a @Component, Boot would also add it to the servlet filter chain
20
// and it would run twice. Keep it only inside the security chain:
21
@Configuration
22
class RequestIdFilterRegistration {
23

24
    @Bean
25
    FilterRegistrationBean<RequestIdFilter> requestIdFilterRegistration(RequestIdFilter filter) {
26
        var registration = new FilterRegistrationBean<>(filter);
27
        registration.setEnabled(false);
28
        return registration;
29
    }
30
}

1
spring:
2
  security:
3
    oauth2:
4
      resourceserver:
5
        jwt:
6
          issuer-uri: https://auth.bank.example/realms/retail   # keys fetched from its JWKS
7

8
logging:
9
  level:
10
    # Every filter, in order, and the decision each one made. Development only:
11
    # never in production, where it would log customer requests in detail.
12
    org.springframework.security: TRACE

1
@WebMvcTest(controllers = OpsLimitsController.class)
2
@Import({SecurityConfig.class, JwtRolesConfig.class, RequestIdFilter.class})
3
class MobileApiSecurityTest {
4

5
    @Autowired MockMvc mvc;
6
    @MockitoBean LimitService limits;
7
    @MockitoBean JwtDecoder jwtDecoder;     // no real issuer in a slice test
8

9
    @Test
10
    void noTokenIsUnauthorized() throws Exception {
11
        mvc.perform(get("/api/ops/limits")).andExpect(status().isUnauthorized());
12
    }
13

14
    @Test
15
    void aCustomerCannotReachOperations() throws Exception {
16
        mvc.perform(get("/api/ops/limits").with(jwt().authorities(new SimpleGrantedAuthority("ROLE_CUSTOMER"))))
17
                .andExpect(status().isForbidden());
18
    }
19

20
    @Test
21
    void operationsIsAllowed() throws Exception {
22
        mvc.perform(get("/api/ops/limits").with(jwt().authorities(new SimpleGrantedAuthority("ROLE_OPERATIONS"))))
23
                .andExpect(status().isOk());
24
    }
25
}