package istata;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;

@Configuration
@EnableWebMvcSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                // .antMatchers("/", "/home").permitAll()
                .anyRequest().authenticated().and().formLogin()
                .loginPage("/login").permitAll().and().logout().permitAll();

        // FIXME, we might want to have this enabled at some point ar at least
        // for some resources
        http.csrf().disable();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth)
            throws Exception {
        String password = ""
                + (Math.round(Math.random() * 899999999) + 100000000);
        System.out.println("The password is: " + password);
        auth.inMemoryAuthentication().withUser("user").password(password)
                .roles("USER");
    }
}
@@ -1201,32 +1201,94 @@
 ows Exception %7B%0A
+        // turns out this happens automatically - go spring%0A//
         String p
@@ -1300,16 +1300,18 @@
 rd = %22%22%0A
+//
         
@@ -1373,16 +1373,18 @@
 00000);%0A
+//
         
@@ -1435,16 +1435,18 @@
 sword);%0A
+//
         
@@ -1511,16 +1511,18 @@
 ssword)%0A
+//
         

remove the custom password creation in favour of the default behaviour (which can be changed in the config rather than being hard coded)