From db7f6511575e1b0fcdfb0524438b5f0b2b49f36c Mon Sep 17 00:00:00 2001
From: tliero <tliero@gmx.net>
Date: Tue, 26 Jul 2016 22:53:25 +0200
Subject: [PATCH] Allow caching of public resources with
 http://stackoverflow.com/a/36293562/3761783

---
 .../de/tilman/transactions/Application.java   |   3 --
 .../transactions/SecurityConfiguration.java   |  43 +++++++++++++-----
 src/main/resources/static/css/app.css         |   2 +-
 .../static/{ => public}/background.png        | Bin
 4 files changed, 33 insertions(+), 15 deletions(-)
 rename src/main/resources/static/{ => public}/background.png (100%)

diff --git a/src/main/java/de/tilman/transactions/Application.java b/src/main/java/de/tilman/transactions/Application.java
index 62317cd..c4657a9 100644
--- a/src/main/java/de/tilman/transactions/Application.java
+++ b/src/main/java/de/tilman/transactions/Application.java
@@ -1,10 +1,7 @@
 package de.tilman.transactions;
 
-import org.h2.server.web.WebServlet;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
-import org.springframework.boot.context.embedded.ServletRegistrationBean;
-import org.springframework.context.annotation.Bean;
 
 @SpringBootApplication
 public class Application {
diff --git a/src/main/java/de/tilman/transactions/SecurityConfiguration.java b/src/main/java/de/tilman/transactions/SecurityConfiguration.java
index 2dc0092..8a5f07a 100644
--- a/src/main/java/de/tilman/transactions/SecurityConfiguration.java
+++ b/src/main/java/de/tilman/transactions/SecurityConfiguration.java
@@ -1,5 +1,8 @@
 package de.tilman.transactions;
 
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
@@ -7,6 +10,8 @@ import org.springframework.security.config.annotation.method.configuration.Enabl
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.header.HeaderWriter;
+import org.springframework.security.web.header.writers.CacheControlHeadersWriter;
 
 @Configuration
 @EnableGlobalMethodSecurity(prePostEnabled = true)
@@ -15,23 +20,39 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 
 	@Override
 	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-		auth.inMemoryAuthentication()
-			.withUser("adam").password("test").roles("USER", "ADMIN").and()
-			.withUser("betty").password("test").roles("USER");
+		auth.inMemoryAuthentication().withUser("adam").password("test").roles("USER", "ADMIN").and().withUser("betty")
+				.password("test").roles("USER");
 	}
 
 	@Override
 	protected void configure(HttpSecurity http) throws Exception {
 		// Basis-Schutz: Nur autorisierte Zugriffe (feingranulare Steuerung über Assertions)
-		http.authorizeRequests()
-			.antMatchers(HttpMethod.GET, "/public/**").permitAll()
-//			.antMatchers("/console/**").permitAll() // H2 console for the dev database
-			.anyRequest().authenticated();
-		
-//		http.httpBasic(); // XXX mit HTTP Basic Auth funktioniert der Logout nicht richtig
+		http.authorizeRequests().antMatchers(HttpMethod.GET, "/public/**").permitAll()
+		// .antMatchers("/console/**").permitAll() // H2 console for the dev database
+				.anyRequest().authenticated();
+
 		http.formLogin();
-		
+
 		http.csrf().disable(); // XXX später wieder aktivieren
-//		http.headers().frameOptions().disable(); // for H2 console
+		// http.headers().frameOptions().disable(); // for H2 console
+
+		// configure caching
+		http.headers().cacheControl().disable();
+
+		http.headers().addHeaderWriter(new HeaderWriter() {
+			
+			CacheControlHeadersWriter originalWriter = new CacheControlHeadersWriter();
+
+			@Override
+			public void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
+				String requestUri = request.getRequestURI();
+				if (!requestUri.startsWith("/public")) {
+					originalWriter.writeHeaders(request, response);
+				} else {
+					response.setHeader("Cache-Control", "public, max-age=10000000");
+				}
+			}
+		});
 	}
+
 }
diff --git a/src/main/resources/static/css/app.css b/src/main/resources/static/css/app.css
index 4aa9a6f..a93e58a 100644
--- a/src/main/resources/static/css/app.css
+++ b/src/main/resources/static/css/app.css
@@ -1,7 +1,7 @@
 body {
 	font-family: "Open Sans", sans-serif;
 	padding: 20px;
-	background: url(/background.png) no-repeat center center fixed;
+	background: url(/public/background.png) no-repeat center center fixed;
 	background-size: cover;
 }
 
diff --git a/src/main/resources/static/background.png b/src/main/resources/static/public/background.png
similarity index 100%
rename from src/main/resources/static/background.png
rename to src/main/resources/static/public/background.png