From ffe7db80b440a659da3bf6f9c09987ace861bba9 Mon Sep 17 00:00:00 2001 From: Kamal Wickramanayake Date: Fri, 3 Jul 2026 22:05:24 +0530 Subject: Prevent roles of all users being accessed via API gateway /bff/api/ path --- .../src/main/java/com/example/resourceserver/config/SecurityConfig.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'microservices/03-resource-server/src/main/java/com/example/resourceserver/config') diff --git a/microservices/03-resource-server/src/main/java/com/example/resourceserver/config/SecurityConfig.java b/microservices/03-resource-server/src/main/java/com/example/resourceserver/config/SecurityConfig.java index 7102e69..bf9dbe5 100644 --- a/microservices/03-resource-server/src/main/java/com/example/resourceserver/config/SecurityConfig.java +++ b/microservices/03-resource-server/src/main/java/com/example/resourceserver/config/SecurityConfig.java @@ -18,7 +18,7 @@ public class SecurityConfig { http .authorizeHttpRequests(authorize -> authorize // 1. Specify the URL to allow without restrictions - .requestMatchers("/api/security/users/*/roles", "/public/**").permitAll() + .requestMatchers("/security/open/users/*/roles", "/public/**").permitAll() // 2. Require authentication for all other requests .anyRequest().authenticated() ) -- cgit v1.2.3