cors security added

baasDOSLcl/src/main/java/com/bankaudit/jwthelper/JwtTokenFilter.java

@@ -7,7 +7,6 @@ import com.bankaudit.repository.UserRepository;
 import com.bankaudit.repository.UserSessionRepository;
 import com.fasterxml.jackson.databind.ObjectMapper;
 
-
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpStatus;
 import org.springframework.stereotype.Component;
@@ -36,24 +35,20 @@ public class JwtTokenFilter extends OncePerRequestFilter {
     @Value("${isdev}")
     private boolean isDev;
     private final AntPathMatcher pathMatcher = new AntPathMatcher();
-    private final List<String> excludedEndpoints = Arrays.asList("/api/user/healthCheck", "/api/user/login","/swagger-ui.html",
+    private final List<String> excludedEndpoints = Arrays.asList("/api/user/healthCheck", "/api/user/login",
-            "/swagger-ui/**", "/v3/api-docs/**","/v2/api-docs/**", "/swagger-resources/**", "/webjars/**","/api/swagger-ui.html",
+            "/swagger-ui.html",
-            "/api/swagger-ui/**", "/api/v3/api-docs/**","/api/v2/api-docs/**", "/api/swagger-resources/**", "/api/webjars/**",
+            "/swagger-ui/**", "/v3/api-docs/**", "/v2/api-docs/**", "/swagger-resources/**", "/webjars/**",
-            "/api/users/forgot-password", "/api/users/validate-otp", "/api/roles","/api/user/validateUserWithIdandMobile","/api/user/validateToken","/api/user/resetPassword");
+            "/api/swagger-ui.html",
+            "/api/swagger-ui/**", "/api/v3/api-docs/**", "/api/v2/api-docs/**", "/api/swagger-resources/**",
+            "/api/webjars/**",
+            "/api/users/forgot-password", "/api/users/validate-otp", "/api/roles",
+            "/api/user/validateUserWithIdandMobile", "/api/user/validateToken", "/api/user/resetPassword");
 
     @Override
     protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
             throws ServletException, IOException {
         String requestPath;
         requestPath = request.getRequestURI().substring(request.getContextPath().length());
-
-        response.setHeader("Access-Control-Allow-Origin", "*");
-        response.setHeader("Access-Control-Allow-Methods", "POST, GET, OPTIONS, DELETE, PUT");
-        response.setHeader("Access-Control-Max-Age", "3600");
-        if ("OPTIONS".equals(request.getMethod())) {
-            response.setStatus(HttpServletResponse.SC_OK);
-            return;
-        } else {
         if (isExcludedEndpoint(requestPath)) {
             filterChain.doFilter(request, response);
             return;
@@ -84,7 +79,8 @@ public class JwtTokenFilter extends OncePerRequestFilter {
         }
         String userId = JwtTokenUtil.getUserIdFromJwt(token);
         String legalEntityCode = JwtTokenUtil.getLeCodeFromJwt(token);
-            UserSession userDetails = userSessionRepository.findByUserIdAndLegalEntityCode(userId, Integer.parseInt(legalEntityCode));
+        UserSession userDetails = userSessionRepository.findByUserIdAndLegalEntityCode(userId,
+                Integer.parseInt(legalEntityCode));
 
         if (JwtTokenUtil.getUserIdFromJwt(token) == null || userDetails == null) {
             String message = "Not a valid session";
@@ -130,10 +126,7 @@ public class JwtTokenFilter extends OncePerRequestFilter {
             response.setCharacterEncoding("UTF-8");
             return;
         }
-
-
         filterChain.doFilter(request, response);
-        }
 
     }
 

baasDOSLcl/src/main/java/com/bankaudit/security/SecurityConfig.java

@@ -0,0 +1,40 @@
+package com.bankaudit.security;
+
+import java.util.List;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
+
+@Configuration
+public class SecurityConfig {
+
+    @Bean
+    public CorsConfigurationSource corsConfigurationSource() {
+        CorsConfiguration config = new CorsConfiguration();
+        config.setAllowedOriginPatterns(List.of("http://localhost:4200","https://openledger-sit.finakon.in")); // Don't use "*" with credentials
+        config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS"));
+        config.setAllowedHeaders(List.of("*"));
+        config.setAllowCredentials(true); // Important if Authorization header is used
+
+        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
+        source.registerCorsConfiguration("/**", config);
+        return source;
+    }
+
+    @Bean
+    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+        http
+            .cors().and()
+            .csrf().disable()
+            .authorizeRequests()
+            .anyRequest().permitAll(); // or restrict specific endpoints
+        return http.build();
+    }
+
+
+}