From 623656648ebd5f5cc67f41c916e2977aef52d6c4 Mon Sep 17 00:00:00 2001 From: XuqmGroup Date: Mon, 18 May 2026 14:11:56 +0800 Subject: [PATCH] fix(file-service): restrict file-serving permitAll to GET requests only Upload endpoint (POST) was inadvertently matched by the method-less requestMatchers("/api/file/*") rule. Making it GET-only makes the intent explicit and ensures upload correctly requires a valid JWT. Co-Authored-By: Claude Sonnet 4.6 --- .../main/java/com/xuqm/file/config/SecurityConfig.java | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/file-service/src/main/java/com/xuqm/file/config/SecurityConfig.java b/file-service/src/main/java/com/xuqm/file/config/SecurityConfig.java index 9e8ee15..f9792da 100644 --- a/file-service/src/main/java/com/xuqm/file/config/SecurityConfig.java +++ b/file-service/src/main/java/com/xuqm/file/config/SecurityConfig.java @@ -36,12 +36,12 @@ public class SecurityConfig { .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) .authorizeHttpRequests(auth -> auth .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll() - // Public: serve files by hash and thumbnails - .requestMatchers("/api/file/*/thumbnail").permitAll() - .requestMatchers("/api/file/*").permitAll() + // Public: serve files by hash and thumbnails (GET only — upload requires auth) + .requestMatchers(HttpMethod.GET, "/api/file/*/thumbnail").permitAll() + .requestMatchers(HttpMethod.GET, "/api/file/*").permitAll() // Actuator health & info .requestMatchers("/actuator/**").permitAll() - // Upload requires authentication + // Everything else (including POST /api/file/upload) requires authentication .anyRequest().authenticated() ) .exceptionHandling(ex -> ex