Add session handling

Menkalian · Mar 31, 2023 · efc7818 · efc7818
1 parent b38f036
commit efc7818
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/src/main/kotlin/de/menkalian/pisces/web/config/SecurityConfiguration.kt b/src/main/kotlin/de/menkalian/pisces/web/config/SecurityConfiguration.kt
@@ -5,6 +5,7 @@ import org.springframework.context.annotation.Configuration
 import org.springframework.http.HttpMethod
 import org.springframework.security.config.annotation.web.builders.HttpSecurity
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
+import org.springframework.security.config.http.SessionCreationPolicy
 import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository
 import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizationRequestResolver
 import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestCustomizers
@@ -18,7 +19,11 @@ import org.springframework.security.web.DefaultSecurityFilterChain
 class SecurityConfiguration {
     @Bean
     fun filterChain(http: HttpSecurity, resolver: OAuth2AuthorizationRequestResolver): DefaultSecurityFilterChain {
-        http.authorizeHttpRequests()
+        http.sessionManagement()
+            .sessionCreationPolicy(SessionCreationPolicy.ALWAYS)
+            .maximumSessions(5).and()
+            .and()
+            .authorizeHttpRequests()
             .requestMatchers("/login/**", "/oauth2/authorization/**").permitAll()
             .requestMatchers("/user/details", "/audio/**", "/preload/**").authenticated()
             .requestMatchers(HttpMethod.GET).permitAll()

diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
@@ -9,6 +9,7 @@ spring.datasource.name=pisces
 spring.jpa.generate-ddl=true
 spring.jpa.hibernate.ddl-auto=update
 
+spring.session.timeout=30d
 spring.security.oauth2.client.registration.discord.client-id=REPLACE
 spring.security.oauth2.client.registration.discord.client-secret=REPLACE
 spring.security.oauth2.client.registration.discord.client-authentication-method=post