1 files changed, 41 insertions, 11 deletions
diff --git a/microservices/03-resource-server/src/main/java/com/example/resourceserver/config/SecurityConfig.java b/microservices/03-resource-server/src/main/java/com/example/resourceserver/config/SecurityConfig.java
index bf9dbe5..d91c52a 100644
--- a/microservices/03-resource-server/src/main/java/com/example/resourceserver/config/SecurityConfig.java
+++ b/microservices/03-resource-server/src/main/java/com/example/resourceserver/config/SecurityConfig.java
@@ -1,7 +1,11 @@
 package com.example.resourceserver.config;
 
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.boot.security.autoconfigure.web.servlet.PathRequest;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.core.annotation.Order;
 import org.springframework.security.config.Customizer;
 import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -13,20 +17,46 @@ import org.springframework.security.web.SecurityFilterChain;
 @EnableMethodSecurity
 public class SecurityConfig {
 
+    /**
+     * This filter chain allows H2 database console access.
+     * 
+     * To disable this filter chain, just disable h2 console in application.yaml
+     * 
+     * To access h2 console:
+     *     http://localhost:8052/myservices/h2-console
+     *
+     * @param http
+     * @return
+     * @throws Exception
+     */
     @Bean
-    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+    @Order(1) // Ensures this filter chain is evaluated first
+    @ConditionalOnProperty(name = "spring.h2.console.enabled", havingValue = "true", matchIfMissing = false)
+    public SecurityFilterChain h2ConsoleSecurityFilterChain(HttpSecurity http) throws Exception {
         http
-            .authorizeHttpRequests(authorize -> authorize
-                // 1. Specify the URL to allow without restrictions
-                .requestMatchers("/security/open/users/*/roles", "/public/**").permitAll()
-                // 2. Require authentication for all other requests
-                .anyRequest().authenticated()
-            )
-            // 3. Configure the app as an OAuth2 Resource Server
-            .oauth2ResourceServer(oauth2 -> oauth2
-                .jwt(Customizer.withDefaults())
-            );
+                .securityMatcher(PathRequest.toH2Console()) // Targets only the H2 console path
+                .authorizeHttpRequests(auth -> auth.anyRequest().permitAll()) // Allows public access
+                .csrf(csrf -> csrf.disable()) // Disables CSRF protection for H2 console
+                .headers(headers -> headers.frameOptions(frame -> frame.sameOrigin())); // Allows iframe rendering
+                                                                                        // from same origin
 
         return http.build();
     }
+
+    @Bean
+    @Order(2) // Evaluated after the H2 console filter chain
+    public SecurityFilterChain apiSecurityFilterChain(HttpSecurity http) throws Exception {
+        http
+                .authorizeHttpRequests(authorize -> authorize
+                        // 1. Specify the URL to allow without restrictions
+                        .requestMatchers("/security/open/users/*/roles", "/public/**").permitAll()
+                        // 2. Require authentication for all other requests
+                        .anyRequest().authenticated())
+                // 3. Configure the app as an OAuth2 Resource Server
+                .oauth2ResourceServer(oauth2 -> oauth2
+                        .jwt(Customizer.withDefaults()));
+
+        return http.build();
+    }
+
 }