From a921d084db59632a59123ef2deaecb090de8fef3 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 30 Sep 2026 16:17:06 +0000
Subject: [PATCH] feature: COG-1152 SecurityConfig hygiene + widen password
 encoder bean to PasswordEncoder

Co-Authored-By: patrick.bradley <patrick.bradley@cognition.ai>
---
 .../main/java/com/userFront/config/SecurityConfig.java | 10 +++-------
 .../service/UserServiceImpl/UserServiceImpl.java       |  4 ++--
 2 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/UserFront/src/main/java/com/userFront/config/SecurityConfig.java b/UserFront/src/main/java/com/userFront/config/SecurityConfig.java
index 40b10417..05f2ede9 100644
--- a/UserFront/src/main/java/com/userFront/config/SecurityConfig.java
+++ b/UserFront/src/main/java/com/userFront/config/SecurityConfig.java
@@ -6,13 +6,13 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.core.env.Environment;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
 
 import com.userFront.service.UserServiceImpl.UserSecurityService;
@@ -22,16 +22,13 @@
 @EnableGlobalMethodSecurity(prePostEnabled=true)
 public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
-    @Autowired
-    private Environment env;
-
     @Autowired
     private UserSecurityService userSecurityService;
 
     private static final String SALT = "salt"; // Salt should be protected carefully
 
     @Bean
-    public BCryptPasswordEncoder passwordEncoder() {
+    public PasswordEncoder passwordEncoder() {
         return new BCryptPasswordEncoder(12, new SecureRandom(SALT.getBytes()));
     }
 
@@ -43,8 +40,7 @@ public BCryptPasswordEncoder passwordEncoder() {
             "/",
             "/about/**",
             "/contact/**",
-            "/error/**/*",
-            "/console/**",
+            "/error/**",
             "/signup"
     };
 
diff --git a/UserFront/src/main/java/com/userFront/service/UserServiceImpl/UserServiceImpl.java b/UserFront/src/main/java/com/userFront/service/UserServiceImpl/UserServiceImpl.java
index c29383e6..a3741042 100644
--- a/UserFront/src/main/java/com/userFront/service/UserServiceImpl/UserServiceImpl.java
+++ b/UserFront/src/main/java/com/userFront/service/UserServiceImpl/UserServiceImpl.java
@@ -6,7 +6,7 @@
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -33,7 +33,7 @@ public class UserServiceImpl implements UserService {
 	private AccountService accountService;
 	
 	@Autowired
-	private BCryptPasswordEncoder passwordEncoder;
+	private PasswordEncoder passwordEncoder;
 
 	public void save(User user) {
 		userDao.save(user);