-
Notifications
You must be signed in to change notification settings - Fork 0
Add authentication endpoint #14
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from 4 commits
44b7dab
2e59fa4
f1362f3
5ba2dab
2794d25
853ceae
7ff4ab7
f2f13f5
678bd58
1fe7d62
16eb749
54c13b6
6625f11
6577982
8237ca6
847fa97
3d834ca
43e1404
fc1c33a
fdfbead
27580bd
b51fda7
678200a
4689df1
dbdd6a0
6a431e1
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,28 @@ | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| package com.otavio.aifoodapp.controller; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import com.otavio.aifoodapp.dto.AuthenticationDTO; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import org.springframework.beans.factory.annotation.Autowired; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import org.springframework.http.ResponseEntity; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import org.springframework.security.authentication.AuthenticationManager; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import org.springframework.web.bind.annotation.PostMapping; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import org.springframework.web.bind.annotation.RequestBody; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import org.springframework.web.bind.annotation.RequestMapping; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import org.springframework.web.bind.annotation.RestController; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| import javax.validation.Valid; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| @RestController | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| @RequestMapping("/api/auth") | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| public class AuthenticationController { | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| @Autowired | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| private AuthenticationManager authenticationManager; | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| public class AuthenticationController { | |
| @Autowired | |
| private AuthenticationManager authenticationManager; | |
| public class AuthenticationController { | |
| private final AuthenticationManager authenticationManager; | |
| public AuthenticationController(AuthenticationManager authenticationManager) { | |
| this.authenticationManager = authenticationManager; | |
| } |
Original comment in English
suggestion: Prefer constructor injection over field injection
It improves testability and makes dependencies explicit.
| public class AuthenticationController { | |
| @Autowired | |
| private AuthenticationManager authenticationManager; | |
| public class AuthenticationController { | |
| private final AuthenticationManager authenticationManager; | |
| public AuthenticationController(AuthenticationManager authenticationManager) { | |
| this.authenticationManager = authenticationManager; | |
| } |
Outdated
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🚨 issue (security): Evite retornar o objeto Authentication completo na resposta
Retorne apenas os dados de autenticação necessários, como um token JWT ou um DTO mínimo, para evitar expor detalhes de segurança internos.
Original comment in English
🚨 issue (security): Avoid returning full Authentication object in response
Return only the necessary authentication data, such as a JWT token or a minimal DTO, to avoid exposing internal security details.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
suggestion: Especifique um tipo genérico para ResponseEntity
Usar um tipo específico como ResponseEntity<Authentication> ou um DTO personalizado melhora a segurança de tipo e evita tipos brutos.
| @PostMapping("/login") | |
| public ResponseEntity login(@RequestBody @Valid AuthenticationDTO data) { | |
| var usernamePassword = new UsernamePasswordAuthenticationToken(data.login(), data.password()); | |
| var auth = this.authenticationManager.authenticate(usernamePassword); | |
| return ResponseEntity.ok(auth); | |
| } | |
| @PostMapping("/login") | |
| public ResponseEntity<Authentication> login(@RequestBody @Valid AuthenticationDTO data) { | |
| var usernamePassword = new UsernamePasswordAuthenticationToken(data.login(), data.password()); | |
| var auth = this.authenticationManager.authenticate(usernamePassword); | |
| return ResponseEntity.ok(auth); | |
| } |
Original comment in English
suggestion: Specify a generic type for ResponseEntity
Using a specific type like ResponseEntity<Authentication> or a custom DTO enhances type safety and avoids raw types.
| @PostMapping("/login") | |
| public ResponseEntity login(@RequestBody @Valid AuthenticationDTO data) { | |
| var usernamePassword = new UsernamePasswordAuthenticationToken(data.login(), data.password()); | |
| var auth = this.authenticationManager.authenticate(usernamePassword); | |
| return ResponseEntity.ok(auth); | |
| } | |
| @PostMapping("/login") | |
| public ResponseEntity<Authentication> login(@RequestBody @Valid AuthenticationDTO data) { | |
| var usernamePassword = new UsernamePasswordAuthenticationToken(data.login(), data.password()); | |
| var auth = this.authenticationManager.authenticate(usernamePassword); | |
| return ResponseEntity.ok(auth); | |
| } |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| package com.otavio.aifoodapp.dto; | ||
|
|
||
| public record AuthenticationDTO(String login, String password) { | ||
OtavioXimarelli marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| } | ||
Uh oh!
There was an error while loading. Please reload this page.