Added Spring Boot role based security sample application

1 files changed, 36 insertions, 0 deletions

diff --git a/spring-boot/10-role-based-security/src/main/java/com/example/spring/config/SecurityConfig.java b/spring-boot/10-role-based-security/src/main/java/com/example/spring/config/SecurityConfig.java
new file mode 100644
index 0000000..8359405
--- /dev/null
+++ b/spring-boot/10-role-based-security/src/main/java/com/example/spring/config/SecurityConfig.java
@@ -0,0 +1,36 @@
+package com.example.spring.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.crypto.argon2.Argon2PasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.web.SecurityFilterChain;
+
+@Configuration
+@EnableWebSecurity
+@EnableMethodSecurity
+public class SecurityConfig {
+
+    @Bean
+    public PasswordEncoder passwordEncoder() {
+        // An Argon2 password encoder with a salt length of 16 bytes, a hash length of 32 bytes, parallelism of 1, memory cost of 1 << 14 (i.e. 16MB) and 2 iterations.
+        return Argon2PasswordEncoder.defaultsForSpringSecurity_v5_8();
+    }
+
+    // @Bean
+    // public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+    //     http
+    //         //.csrf(csrf -> csrf.disable()) // Disable for stateless REST APIs
+    //         .authorizeHttpRequests(auth -> auth
+    //             .requestMatchers("/somepath/**").permitAll() // Publicly available
+    //             .requestMatchers("/admin/**").hasRole("ADMIN") // Requires ROLE_ADMIN
+    //             .requestMatchers("/contact/**").hasAnyRole("USER", "ADMIN")
+    //             .anyRequest().authenticated()
+    //         );
+        
+    //     return http.build();
+    // }
+}
\ No newline at end of file