Fixes invalid path patterns resulting in public access being rejected - #157
Merged
DenizAltunkapan merged 1 commit intoOct 1, 2026
Merged
Conversation
vanxa
requested review from
DenizAltunkapan,
GabrielBBaldez and
MaximilianRau04
as code owners
October 1, 2026 20:26
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Agent review
Non-blocking: the change looks correct for the reported Swagger problem, but one edge case and one gap remain.
- Dropped sub-paths:
SecurityConfigno longer adds**to prefixes that don't end in/. This also affects/v3/api-docs, which now matches only that exact path./v3/api-docs.yamland/v3/api-docs?group=...variants are not covered, so they would be rejected for unauthenticated users. The bare/swagger-uipath is now non-public as well.JwtAuthFilterstill usesstartsWithon the same list, so it will skip JWT checks for those paths while the authorization rules still reject them. If the.yamlendpoint is needed, add an explicit/v3/api-docs.yamlentry. - No test: There is no test that the public paths are reachable without a token. One
MockMvctest covering/v3/api-docs,/swagger-ui/index.htmland/s/...would prevent this class of regression.
Generated by Pull Request Review for #157 · copilot · auto · 14.3 AIC · ⌖ 5.9 AIC · ⊞ 7K
Fixes `PublicPaths#PREFIXES` to include `v3/api-docs` and `swagger-ui` Fixes `SecurityConfig#filterChain` to add `*/**` wildcard for leaf paths and `**` wildcard for traversable paths (i.e. terminating in '/') Signed-off-by: Ivan Konstantinov <1674639+vanxa@users.noreply.github.com>
vanxa
force-pushed
the
156/fix-filepath-filter-patterns
branch
from
October 1, 2026 20:46
058f394 to
5646307
Compare
Contributor
Author
Added |
There was a problem hiding this comment.
Agent review
Suggestion: approve. I did not find any high-confidence correctness, security, regression, or missing-test issues in this diff.
Generated by Pull Request Review for #157 · copilot · auto · 15 AIC · ⌖ 5.42 AIC · ⊞ 7K
DenizAltunkapan
approved these changes
Oct 1, 2026
Member
|
@vanxa thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes invalid path patterns resulting in public access being rejected
Summary
PublicPaths#PREFIXESto includev3/api-docs/andswagger-ui/SecurityConfig#filterChainto add*/**wildcard for lead items (i.e.swagger-ui) and**wildcard for non-leaf ones (i.e./api/auth/), removing the need to declare duplicate paths with and without a terminating slashLinked issue
Closes #156
How to test
Run the app in local dev environment and observe that swagger UI can now be opened.