@Override
    protected void configure(HttpSecurity http) throws Exception {
        // Gets a secure random key for the remember be token key
        SecureRandom random = new SecureRandom();
        byte[] randomBytes = new byte[64];
        random.nextBytes(randomBytes);
        String rememberBeKey = new String(Hex.encode(randomBytes));
        // @formatter:off
        http.antMatcher("/**")
            // Only BASIC authentication
            .httpBasic()
                .authenticationEntryPoint(apiBasicAuthenticationEntryPoint)
                .realmName("ontrack")
                .and()
            // Logout set-up
            .logout()
                .logoutUrl("/user/logout")
                .logoutSuccessUrl("/user/logged-out")
                .addLogoutHandler(basicRememberMeUserDetailsService())
                .and()
            // FIXME CSRF protection for a stateless API?
            //.csrf().requireCsrfProtectionMatcher(new CSRFRequestMatcher()).and()
            .csrf().disable()
            // Allows all at Web level
            .authorizeRequests()
                .antMatchers("/**").permitAll()
            // Remember be authentication token
            .and().rememberMe()
                .rememberMeServices(rememberMeServices(rememberBeKey))
                .key(rememberBeKey)
                .tokenValiditySeconds(604800)
            // Cache enabled
            .and().headers().cacheControl().disable()
        ;
        // @formatter:on
    }
@ Override protected void configure ( HttpSecurity http ) throws Exception { SecureRandom random = new SecureRandom ( ) ; byte [ ] randomBytes = new byte [ 64 ] ; random . nextBytes ( randomBytes ) ; String rememberBeKey = new String ( Hex . encode ( randomBytes ) ) ; http . antMatcher ( "/**" ) . httpBasic ( ) . authenticationEntryPoint ( apiBasicAuthenticationEntryPoint ) . realmName ( "ontrack" ) . and ( ) . logout ( ) . logoutUrl ( "/user/logout" ) . logoutSuccessUrl ( "/user/logged-out" ) . addLogoutHandler ( basicRememberMeUserDetailsService ( ) ) . and ( ) . csrf ( ) . disable ( ) . authorizeRequests ( ) . antMatchers ( "/**" ) . permitAll ( ) . and ( ) . rememberMe ( ) . rememberMeServices ( rememberMeServices ( rememberBeKey ) ) . key ( rememberBeKey ) . tokenValiditySeconds ( 604800 ) . and ( ) . headers ( ) . cacheControl ( ) . disable ( ) ; }
By default, all queries are accessible anonymously. Security is enforced at service level.