content: package com.luv2shopdev.ecommerce.config;
  
  import com.okta.spring.boot.oauth.Okta;
  import org.springframework.context.annotation.Bean;
  import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.web.SecurityFilterChain;
  import org.springframework.web.accept.ContentNegotiationStrategy;
  import org.springframework.web.accept.HeaderContentNegotiationStrategy;
  
  @Configuration
  public class SecurityConfig {
  
      @Bean
      protected SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
  
          // protect endpoint /api/orders
          http.authorizeRequests()
                  .antMatchers("/api/orders/**")
                  .authenticated()
                  .and()
                  .oauth2ResourceServer()
                  .jwt();
  
          // add CORS filters
          http.cors();
  
          // add content negotiation strategy
          http.setSharedObject(ContentNegotiationStrategy.class, new HeaderContentNegotiationStrategy());
  
          // force a non-empty response body for 401's to make the response more friendly
          Okta.configureResourceServer401ResponseBody(http);
  
          // disable CSRF since the App is not using Cookies for session tracking
          http.csrf().disable();
  
  
          return http.build();
      }
  }
  
  