Do not save session on 404, secure account endpoints

Author: amontenegro

orcid-web/src/main/java/org/orcid/frontend/spring/session/redis/OrcidRedisIndexedSessionRepository.java

@@ -69,7 +69,7 @@ public class OrcidRedisIndexedSessionRepository implements FindByIndexNameSessio
             "/orgs/disambiguated/ROR", "/peer-reviews/peer-review.json", "/peer-reviews/peer-reviews-by-group-id.json", "/peer-reviews/peer-reviews-minimized.json", "/qr-code.png", "/register.json",
             "/research-resources/researchResource.json", "/research-resources/researchResourcePage.json", "/userInfo.json", "/works/getWorkInfo.json", "/works/groupingSuggestions.json", "/works/idTypes.json", "/works/work.json",
             "/works/worksExtendedPage.json", "/404");
-    private final List<String> urisToSkipAlways = List.of("/oauth/custom/register/validatePassword.json");
+    private final List<String> urisToSkipAlways = List.of("/oauth/custom/register/validatePassword.json", "/404");
     private final Set<String> GET_SKIP_SAVE_SESSION = new HashSet<>(urisToSkipOnGet);
     private final Set<String> ALWAYS_SKIP_SAVE_SESSION = new HashSet<>(urisToSkipAlways);
 

orcid-web/src/main/resources/orcid-frontend-security.xml

@@ -410,6 +410,8 @@
 			access="ROLE_USER"/>
 		<sec:intercept-url pattern="/get-my-data"
 			access="ROLE_USER"/>
+		<sec:intercept-url pattern="/account/.*"
+			access="ROLE_USER"/>
 		<sec:intercept-url pattern="/verify-email/[a-zA-Z0-9_-]+(\?lang=[a-zA-Z]*)?"
 			access="IS_AUTHENTICATED_ANONYMOUSLY" />
 		<sec:intercept-url pattern="/userInfo.json(\?.*)?"