git » subscription-tool.git » commit 136fe72

changed security and error handling

author Thorsten Ortlepp
2025-12-12 21:49:32 UTC
committer Thorsten Ortlepp
2025-12-12 21:49:32 UTC
parent 233b13409033fecc461a5163d1ae5f0db436d2a3

changed security and error handling

src/main/java/dev/rubidium/subscriptiontool/configuration/SecurityConfiguration.java +3 -3
src/main/java/dev/rubidium/subscriptiontool/controller/CustomErrorController.java +23 -0
src/main/java/dev/rubidium/subscriptiontool/controller/SubscriptionController.java +1 -1
src/main/java/dev/rubidium/subscriptiontool/properties/Translation.java +3 -1
src/main/resources/templates/Error.html +20 -0
src/main/resources/translation.properties +2 -0

diff --git a/src/main/java/dev/rubidium/subscriptiontool/configuration/SecurityConfiguration.java b/src/main/java/dev/rubidium/subscriptiontool/configuration/SecurityConfiguration.java
index 624f73c..1af5023 100644
--- a/src/main/java/dev/rubidium/subscriptiontool/configuration/SecurityConfiguration.java
+++ b/src/main/java/dev/rubidium/subscriptiontool/configuration/SecurityConfiguration.java
@@ -28,10 +28,10 @@ public class SecurityConfiguration {
   public SecurityFilterChain defaultHttpSecurity(HttpSecurity httpSecurity) {
     httpSecurity
         .authorizeHttpRequests((requests) -> requests
-            .requestMatchers("/", "/subscribe", "/unsubscribe", "/confirm", "/bootstrap.min.css")
-            .permitAll()
+            .requestMatchers("/actuator", "/actuator/**")
+            .authenticated()
             .anyRequest()
-            .authenticated())
+            .permitAll())
         .httpBasic(Customizer.withDefaults());
     return httpSecurity.build();
   }
diff --git a/src/main/java/dev/rubidium/subscriptiontool/controller/CustomErrorController.java b/src/main/java/dev/rubidium/subscriptiontool/controller/CustomErrorController.java
new file mode 100644
index 0000000..e7a3a42
--- /dev/null
+++ b/src/main/java/dev/rubidium/subscriptiontool/controller/CustomErrorController.java
@@ -0,0 +1,23 @@
+package dev.rubidium.subscriptiontool.controller;
+
+import dev.rubidium.subscriptiontool.properties.Translation;
+import org.springframework.boot.webmvc.error.ErrorController;
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+@Controller
+public class CustomErrorController implements ErrorController {
+
+  private final Translation translation;
+
+  public CustomErrorController(final Translation translation) {
+    this.translation = translation;
+  }
+
+  @RequestMapping("/error")
+  public String handleError(Model model) {
+    model.addAttribute("translation", translation);
+    return "Error";
+  }
+}
diff --git a/src/main/java/dev/rubidium/subscriptiontool/controller/SubscriptionController.java b/src/main/java/dev/rubidium/subscriptiontool/controller/SubscriptionController.java
index 92d68f3..f6c5486 100644
--- a/src/main/java/dev/rubidium/subscriptiontool/controller/SubscriptionController.java
+++ b/src/main/java/dev/rubidium/subscriptiontool/controller/SubscriptionController.java
@@ -74,7 +74,7 @@ public class SubscriptionController {
   }
 
   @GetMapping("/confirm")
-  public String confirm(@RequestParam(name = "code") String code, Model model) {
+  public String confirm(@RequestParam(name = "code", required = false) String code, Model model) {
     boolean confirmed = false;
     String confirmationCode = cleanInput(code);
     if (!confirmationCode.isEmpty()) {
diff --git a/src/main/java/dev/rubidium/subscriptiontool/properties/Translation.java b/src/main/java/dev/rubidium/subscriptiontool/properties/Translation.java
index 5e70396..1f60f64 100644
--- a/src/main/java/dev/rubidium/subscriptiontool/properties/Translation.java
+++ b/src/main/java/dev/rubidium/subscriptiontool/properties/Translation.java
@@ -18,6 +18,8 @@ public record Translation(String title,
                           String emailPlaceholder,
                           String back,
                           String mailSubject,
-                          String mailText) {
+                          String mailText,
+                          String error,
+                          String home) {
 
 }
diff --git a/src/main/resources/templates/Error.html b/src/main/resources/templates/Error.html
new file mode 100644
index 0000000..dc538e5
--- /dev/null
+++ b/src/main/resources/templates/Error.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<html xmlns:th="http://www.thymeleaf.org" lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <link href="/bootstrap.min.css" rel="stylesheet">
+  <title th:text="${translation.title()}"/>
+</head>
+<body>
+<div class="container-fluid">
+  <h1 class="text-center fs-3" th:text="${translation.title()}"/>
+  <h1 class="text-center fs-4 text-danger" th:text="${translation.error()}"/>
+  <div class="row">
+    <div class="col my-3 text-center">
+      <a href="/" class="btn btn-primary" th:text="${translation.home()}"/>
+    </div>
+  </div>
+</div>
+</body>
+</html>
diff --git a/src/main/resources/translation.properties b/src/main/resources/translation.properties
index 749deeb..0ca249f 100644
--- a/src/main/resources/translation.properties
+++ b/src/main/resources/translation.properties
@@ -14,3 +14,5 @@ translation.emailPlaceholder=Your email address
 translation.back=Back
 translation.mailSubject=Please confirm your subscription
 translation.mailText=Hi,\n\nplease confirm your subscription by clicking the following link:\n%s\n\nBest regards
+translation.error=An error occurred
+translation.home=Home
\ No newline at end of file