Refactoring
This commit is contained in:
dahoud
@@ -9,11 +9,41 @@ quarkus.http.so-reuse-port=true
|
||||
quarkus.http.tcp-quick-ack=true
|
||||
quarkus.http.tcp-cork=true
|
||||
|
||||
# Configuration Session HTTP - Production
|
||||
quarkus.http.session-timeout=60m
|
||||
quarkus.http.session-cookie-same-site=strict
|
||||
quarkus.http.session-cookie-http-only=true
|
||||
quarkus.http.session-cookie-secure=true
|
||||
# ===================================================================================================
|
||||
# Headers de Sécurité HTTP - PRODUCTION
|
||||
# ===================================================================================================
|
||||
# Prévention du MIME sniffing
|
||||
quarkus.http.header."X-Content-Type-Options".value=nosniff
|
||||
quarkus.http.header."X-Content-Type-Options".methods=GET,POST,PUT,DELETE,PATCH
|
||||
|
||||
# Protection contre le clickjacking
|
||||
quarkus.http.header."X-Frame-Options".value=DENY
|
||||
quarkus.http.header."X-Frame-Options".methods=GET,POST,PUT,DELETE,PATCH
|
||||
|
||||
# HSTS - Force HTTPS pour 1 an
|
||||
quarkus.http.header."Strict-Transport-Security".value=max-age=31536000; includeSubDomains; preload
|
||||
quarkus.http.header."Strict-Transport-Security".methods=GET,POST,PUT,DELETE,PATCH
|
||||
|
||||
# Content Security Policy
|
||||
# Permet 'unsafe-inline' pour PrimeFaces/JSF qui génèrent des scripts inline
|
||||
quarkus.http.header."Content-Security-Policy".value=default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'none'
|
||||
quarkus.http.header."Content-Security-Policy".methods=GET,POST,PUT,DELETE,PATCH
|
||||
|
||||
# Protection XSS (legacy, mais utile pour anciens navigateurs)
|
||||
quarkus.http.header."X-XSS-Protection".value=1; mode=block
|
||||
quarkus.http.header."X-XSS-Protection".methods=GET,POST,PUT,DELETE,PATCH
|
||||
|
||||
# Politique de référents
|
||||
quarkus.http.header."Referrer-Policy".value=strict-origin-when-cross-origin
|
||||
quarkus.http.header."Referrer-Policy".methods=GET,POST,PUT,DELETE,PATCH
|
||||
|
||||
# Permissions Policy (anciennement Feature-Policy)
|
||||
quarkus.http.header."Permissions-Policy".value=geolocation=(), microphone=(), camera=()
|
||||
quarkus.http.header."Permissions-Policy".methods=GET,POST,PUT,DELETE,PATCH
|
||||
|
||||
# Compression HTTP pour améliorer les performances
|
||||
quarkus.http.enable-compression=true
|
||||
quarkus.http.compression-level=6
|
||||
|
||||
# Configuration logging - Production
|
||||
quarkus.log.console.enable=true
|
||||
@@ -23,35 +53,6 @@ quarkus.log.category."dev.lions.unionflow".level=INFO
|
||||
quarkus.log.category."org.primefaces".level=WARN
|
||||
quarkus.log.category."org.apache.myfaces".level=WARN
|
||||
|
||||
# MyFaces Configuration - Production
|
||||
quarkus.myfaces.project-stage=Production
|
||||
quarkus.myfaces.state-saving-method=server
|
||||
quarkus.myfaces.number-of-views-in-session=50
|
||||
quarkus.myfaces.number-of-sequential-views-in-session=10
|
||||
quarkus.myfaces.serialize-state-in-session=false
|
||||
quarkus.myfaces.client-view-state-timeout=3600000
|
||||
quarkus.myfaces.view-expired-exception-handler-redirect-page=/
|
||||
quarkus.myfaces.check-id-production-mode=true
|
||||
quarkus.myfaces.strict-xhtml-links=true
|
||||
quarkus.myfaces.refresh-transient-build-on-pss=true
|
||||
quarkus.myfaces.resource-max-time-expires=604800000
|
||||
quarkus.myfaces.resource-buffer-size=2048
|
||||
|
||||
# PrimeFaces Configuration - Production
|
||||
primefaces.THEME=none
|
||||
primefaces.FONT_AWESOME=true
|
||||
primefaces.CLIENT_SIDE_VALIDATION=true
|
||||
primefaces.MOVE_SCRIPTS_TO_BOTTOM=true
|
||||
primefaces.CSP=true
|
||||
primefaces.UPLOADER=commons
|
||||
primefaces.AUTO_UPDATE=false
|
||||
primefaces.CACHE_PROVIDER=org.primefaces.cache.DefaultCacheProvider
|
||||
primefaces.RESOURCE_HANDLER=org.primefaces.application.resource.PrimeResourceHandler
|
||||
|
||||
# OmniFaces Configuration - Production
|
||||
omnifaces.CDN_RESOURCE_HANDLER_DISABLED=true
|
||||
omnifaces.COMBINED_RESOURCE_HANDLER_DISABLED=false
|
||||
|
||||
# Configuration Backend UnionFlow - Production
|
||||
unionflow.backend.url=${UNIONFLOW_BACKEND_URL:https://api.lions.dev/unionflow}
|
||||
|
||||
@@ -59,8 +60,9 @@ unionflow.backend.url=${UNIONFLOW_BACKEND_URL:https://api.lions.dev/unionflow}
|
||||
quarkus.rest-client."unionflow-api".url=${unionflow.backend.url}
|
||||
quarkus.rest-client."unionflow-api".scope=jakarta.inject.Singleton
|
||||
quarkus.rest-client."unionflow-api".connect-timeout=5000
|
||||
quarkus.rest-client."unionflow-api".read-timeout=30000
|
||||
quarkus.rest-client."unionflow-api".providers=dev.lions.unionflow.client.service.RestClientExceptionMapper,dev.lions.unionflow.client.security.JwtClientRequestFilter
|
||||
quarkus.rest-client."unionflow-api".read-timeout=15000
|
||||
quarkus.rest-client."unionflow-api".providers=dev.lions.unionflow.client.service.RestClientExceptionMapper
|
||||
# NOTE: JwtClientRequestFilter retiré - utilisation de AuthHeaderFactory via @RegisterClientHeaders
|
||||
|
||||
# Configuration Keycloak OIDC - Production
|
||||
quarkus.oidc.enabled=true
|
||||
@@ -68,35 +70,50 @@ quarkus.oidc.auth-server-url=${KEYCLOAK_AUTH_SERVER_URL:https://security.lions.d
|
||||
quarkus.oidc.client-id=unionflow-client
|
||||
quarkus.oidc.credentials.secret=${KEYCLOAK_CLIENT_SECRET}
|
||||
quarkus.oidc.application-type=web-app
|
||||
# Callback path - must match Keycloak Valid Redirect URIs configuration
|
||||
quarkus.oidc.authentication.redirect-path=/auth/callback
|
||||
quarkus.oidc.authentication.force-redirect-https-scheme=true
|
||||
quarkus.oidc.authentication.restore-path-after-redirect=true
|
||||
# Default landing page after successful login
|
||||
quarkus.oidc.authentication.scopes=openid,profile,email,roles
|
||||
quarkus.oidc.token.issuer=https://security.lions.dev/realms/unionflow
|
||||
quarkus.oidc.tls.verification=required
|
||||
quarkus.oidc.authentication.cookie-same-site=lax
|
||||
quarkus.oidc.authentication.java-script-auto-redirect=false
|
||||
quarkus.oidc.discovery-enabled=true
|
||||
quarkus.oidc.verify-access-token=true
|
||||
|
||||
# Activation de la sécurité
|
||||
quarkus.security.auth.enabled=true
|
||||
|
||||
# IMPORTANT: L'ordre des permissions compte - les plus spécifiques doivent être EN PREMIER
|
||||
# Chemins publics (non protégés par OIDC) - Production
|
||||
quarkus.http.auth.permission.public.paths=/,/index.xhtml,/pages/public/*,/auth/*,/q/*,/q/oidc/*,/favicon.ico,/resources/*,/META-INF/resources/*,/images/*,/jakarta.faces.resource/*,/javax.faces.resource/*
|
||||
quarkus.http.auth.permission.public.policy=permit
|
||||
|
||||
# Tous les autres chemins nécessitent une authentification
|
||||
quarkus.http.auth.permission.authenticated.paths=/*
|
||||
quarkus.http.auth.permission.authenticated.paths=/pages/secure/*
|
||||
quarkus.http.auth.permission.authenticated.policy=authenticated
|
||||
|
||||
# Configuration Session - Production
|
||||
# Configuration Session (custom properties, gérées côté applicatif)
|
||||
unionflow.session.timeout=${SESSION_TIMEOUT:1800}
|
||||
unionflow.session.remember-me.duration=${REMEMBER_ME_DURATION:604800}
|
||||
|
||||
# Configuration de sécurité - Production
|
||||
# Configuration de sécurité (custom properties, gérées côté applicatif)
|
||||
unionflow.security.enable-csrf=${ENABLE_CSRF:true}
|
||||
unionflow.security.password.min-length=${PASSWORD_MIN_LENGTH:8}
|
||||
unionflow.security.password.require-special-chars=${PASSWORD_REQUIRE_SPECIAL:true}
|
||||
unionflow.security.max-login-attempts=${MAX_LOGIN_ATTEMPTS:5}
|
||||
unionflow.security.lockout-duration=${LOCKOUT_DURATION:300}
|
||||
|
||||
# ===================================================================================================
|
||||
# Configuration Quarkus Arc CDI - Intégration avec JSF/MyFaces - Production
|
||||
# ===================================================================================================
|
||||
# Active le mode découverte de beans pour permettre à Arc de gérer tous les beans CDI et JSF
|
||||
quarkus.arc.unremovable-types=jakarta.faces.application.Application,jakarta.faces.context.FacesContext,jakarta.enterprise.context.Conversation
|
||||
|
||||
# Permet à Arc de détecter et gérer les beans avec annotations JSF custom scopes (@ViewScoped, etc.)
|
||||
quarkus.arc.detect-unused-false-positives=true
|
||||
|
||||
# Force Arc à gérer les beans même s'ils ne sont pas référencés directement
|
||||
quarkus.arc.remove-unused-beans=false
|
||||
|
||||
# Active le support complet CDI pour JSF Expression Language (EL)
|
||||
# Cela permet à MyFaces d'utiliser Arc BeanManager pour résoudre #{bean.property}
|
||||
quarkus.arc.auto-inject-fields=true
|
||||
|
||||
Reference in New Issue
Block a user