content: /**
   * Copyright (c) 2010-present Abixen Systems. All rights reserved.
   * <p>
   * This library is free software; you can redistribute it and/or modify it under
   * the terms of the GNU Lesser General Public License as published by the Free
   * Software Foundation; either version 2.1 of the License, or (at your option)
   * any later version.
   * <p>
   * This library is distributed in the hope that it will be useful, but WITHOUT
   * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
   * FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
   * details.
   */
  
  package com.abixen.platform.gateway.configuration;
  
  
  import org.springframework.context.annotation.Bean;
  import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
  import org.springframework.security.config.web.server.ServerHttpSecurity;
  import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
  import org.springframework.security.web.server.SecurityWebFilterChain;
  import org.springframework.security.web.server.context.WebSessionServerSecurityContextRepository;
  import org.springframework.security.web.server.csrf.CookieServerCsrfTokenRepository;
  
  
  @EnableWebFluxSecurity
  public class PlatformSecurityConfiguration {
  
      @Bean
      public SecurityWebFilterChain securityFilterChain(ServerHttpSecurity http) {
          return http
                  .httpBasic().securityContextRepository(new WebSessionServerSecurityContextRepository())
                  .and()
                  .authorizeExchange()
                  .pathMatchers("/turbine.stream").permitAll()
                  .pathMatchers("/test").permitAll()
                  .pathMatchers("/service/**").permitAll()
                  .pathMatchers("/api/user").permitAll()
                  .pathMatchers("/api/user-activation/activate/*/").permitAll()
                  .anyExchange().authenticated()
                  .and()
                  .csrf()
                  .csrfTokenRepository(CookieServerCsrfTokenRepository.withHttpOnlyFalse())
                  .and()
                  .build();
      }
  
      @Bean
      public BCryptPasswordEncoder bCryptPasswordEncoder() {
          return new BCryptPasswordEncoder();
      }
  
  }