Allow caching of public resources with

http://stackoverflow.com/a/36293562/3761783

src/main/java/de/tilman/transactions/Application.java

@@ -1,10 +1,7 @@
 package de.tilman.transactions;
 
-import org.h2.server.web.WebServlet;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
-import org.springframework.boot.context.embedded.ServletRegistrationBean;
-import org.springframework.context.annotation.Bean;
 
 @SpringBootApplication
 public class Application {

src/main/java/de/tilman/transactions/SecurityConfiguration.java

@@ -1,5 +1,8 @@
 package de.tilman.transactions;
 
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
@@ -7,6 +10,8 @@ import org.springframework.security.config.annotation.method.configuration.Enabl
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.header.HeaderWriter;
+import org.springframework.security.web.header.writers.CacheControlHeadersWriter;
 
 @Configuration
 @EnableGlobalMethodSecurity(prePostEnabled = true)
@@ -15,23 +20,39 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 
 	@Override
 	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-		auth.inMemoryAuthentication()
+		auth.inMemoryAuthentication().withUser("adam").password("test").roles("USER", "ADMIN").and().withUser("betty")
-			.withUser("adam").password("test").roles("USER", "ADMIN").and()
+				.password("test").roles("USER");
-			.withUser("betty").password("test").roles("USER");
 	}
 
 	@Override
 	protected void configure(HttpSecurity http) throws Exception {
 		// Basis-Schutz: Nur autorisierte Zugriffe (feingranulare Steuerung über Assertions)
-		http.authorizeRequests()
+		http.authorizeRequests().antMatchers(HttpMethod.GET, "/public/**").permitAll()
-			.antMatchers(HttpMethod.GET, "/public/**").permitAll()
 		// .antMatchers("/console/**").permitAll() // H2 console for the dev database
 				.anyRequest().authenticated();
 
-//		http.httpBasic(); // XXX mit HTTP Basic Auth funktioniert der Logout nicht richtig
 		http.formLogin();
 
 		http.csrf().disable(); // XXX später wieder aktivieren
 		// http.headers().frameOptions().disable(); // for H2 console
+
+		// configure caching
+		http.headers().cacheControl().disable();
+
+		http.headers().addHeaderWriter(new HeaderWriter() {
+			
+			CacheControlHeadersWriter originalWriter = new CacheControlHeadersWriter();
+
+			@Override
+			public void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
+				String requestUri = request.getRequestURI();
+				if (!requestUri.startsWith("/public")) {
+					originalWriter.writeHeaders(request, response);
+				} else {
+					response.setHeader("Cache-Control", "public, max-age=10000000");
 				}
 			}
+		});
+	}
+
+}

src/main/resources/static/css/app.css

@@ -1,7 +1,7 @@
 body {
 	font-family: "Open Sans", sans-serif;
 	padding: 20px;
-	background: url(/background.png) no-repeat center center fixed;
+	background: url(/public/background.png) no-repeat center center fixed;
 	background-size: cover;
 }