github-advanced-security[bot] commented on code in PR #53:
URL:
https://github.com/apache/fineract-loan-origination/pull/53#discussion_r3657650245
##########
src/main/java/org/apache/fineract/los/config/SecurityConfig.java:
##########
@@ -19,42 +19,84 @@
package org.apache.fineract.los.config;
+import java.util.List;
+import org.apache.fineract.los.security.JwtAuthFilter;
+import org.apache.fineract.los.security.JwtService;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
+import org.springframework.core.annotation.Order;
import
org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import
org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import
org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
+import
org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
+import org.springframework.web.cors.CorsConfiguration;
+import org.springframework.web.cors.CorsConfigurationSource;
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource;
-/**
- * Security configuration for the Loan Origination Service.
- *
- * <p>This service is a stateless REST API secured via the {@code
X-Fineract-Platform-TenantId}
- * header and Basic authentication. CSRF protection is intentionally disabled
because:
- *
- * <ul>
- * <li>The API is stateless — no session cookies are used
- * <li>All clients are server-side (Angular uses Authorization header, not
cookies)
- * <li>CSRF attacks require cookie-based session state which this service
does not maintain
- * </ul>
- *
- * <p>This follows the standard practice for REST APIs as documented in the
Spring Security
- * reference:
- *
https://docs.spring.io/spring-security/reference/features/exploits/csrf.html#csrf-when-to-use
- */
@Configuration
@EnableMethodSecurity
public class SecurityConfig {
+ /**
+ * Customer-facing security chain. Matched first ({@code @Order(1)}) so any
request under {@code
+ * /api/v1/customer/**} authenticates against {@link
MockCustomerIdentityService} (producing a
+ * {@code CustomerPrincipal}) rather than the static staff account below.
+ *
+ * <p>CORS must be applied here explicitly — it is NOT inherited from the
staff chain, since each
+ * {@code SecurityFilterChain} is independently matched and configured.
+ */
+ /**
+ * JWT chain — covers all /api/v1/** except public and admin endpoints. john
(and any customer)
+ * uses their JWT token here.
+ */
+ @Bean
+ @Order(1)
+ SecurityFilterChain jwtSecurityFilterChain(final HttpSecurity http, final
JwtService jwtService)
+ throws Exception {
+
+ http.securityMatcher("/api/v1/loan-applications/**", "/api/v1/customer/**")
+ .cors(cors -> cors.configurationSource(corsConfigurationSource()))
+ .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
+ .addFilterBefore(new JwtAuthFilter(jwtService),
UsernamePasswordAuthenticationFilter.class)
+ .csrf(AbstractHttpConfigurer::disable)
Review Comment:
## CodeQL / Disabled Spring CSRF protection
CSRF vulnerability due to protection being disabled.
[Show more
details](https://github.com/apache/fineract-loan-origination/security/code-scanning/4)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
