Skip to content

Alba María Álvarez / AppRecetas

Go to a project
Commit 903bc074 by Alba María Álvarez
Options

perf(security): deleteUser autorizado solo a ADMIN

parent 8e4cdf5e
Inline Side-by-side
Showing with 5 additions and 0 deletions
src/main/java/com/example/apprecetas/security/config/SecurityConfig.java
...@@ -30,8 +30,13 @@ public class SecurityConfig { ...@@ -30,8 +30,13 @@ public class SecurityConfig {
.headers(AbstractHttpConfigurer::disable) // necesario para h2-console .headers(AbstractHttpConfigurer::disable) // necesario para h2-console
.httpBasic(AbstractHttpConfigurer::disable) .httpBasic(AbstractHttpConfigurer::disable)
.authorizeHttpRequests(request -> request .authorizeHttpRequests(request -> request
// Para autenticación todos permitidos
.requestMatchers("/auth/**").permitAll() .requestMatchers("/auth/**").permitAll()
// Para ver todos los usuarios, solo ADMIN
.requestMatchers(HttpMethod.GET, "/user").hasRole("ADMIN") .requestMatchers(HttpMethod.GET, "/user").hasRole("ADMIN")
// Para eliminar un usuario, solo ADMIN
.requestMatchers(HttpMethod.DELETE, "/user").hasRole("ADMIN")
// Todo lo demás, autenticados
.anyRequest().authenticated() .anyRequest().authenticated()
) )
.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or sign in to comment