Update POM file with new version: heroku-tst-5

Author: commjoen

.github/scripts/docker-create-and-push.sh

@@ -54,7 +54,7 @@ openssl rand -base64 32 | tr -d '\n' > yourkey.txt
 #echo "</settings>"
 
 echo "Building and updating pom.xml file so we can use it in our docker"
-cd ../.. && mvn clean && mvn --batch-mode release:update-versions -DdevelopmentVersion=${tag}-SNAPSHOT && mvn install -DskipTests
+cd ../.. && mvn clean && mvn --batch-mode release:update-versions -DdevelopmentVersion=${tag}-SNAPSHOT && mvn install
 git add pom.xml
 git commit -am "Update POM file with new version: ${tag}"
 cd .github/scripts && git push

Dockerfile.web

@@ -1,4 +1,4 @@
-FROM jeroenwillemsen/wrongsecrets:heroku-tst-4-no-vault
+FROM jeroenwillemsen/wrongsecrets:heroku-tst-5-no-vault
 
 ARG argBasedVersion="1.3.10"
 ARG CANARY_URLS="http://canarytokens.com/terms/about/s7cfbdakys13246ewd8ivuvku/post.jsp,http://canarytokens.com/terms/about/y0all60b627gzp19ahqh7rl6j/post.jsp"

pom.xml

@@ -9,7 +9,7 @@
     </parent>
     <groupId>org.owasp</groupId>
     <artifactId>wrongsecrets</artifactId>
-    <version>heroku-tst-4-SNAPSHOT</version>
+    <version>heroku-tst-5-SNAPSHOT</version>
     <name>OWASP WrongSecrets</name>
     <description>Examples with how to not use secrets</description>
     <url>https://owasp.org/www-project-wrongsecrets/</url>

src/main/java/org/owasp/wrongsecrets/HerokuWebSecurityConfig.java

@@ -8,7 +8,7 @@
 
 @Configuration
 @EnableWebSecurity(debug = true)
-@Order(0)
+@Order(1)
 public class HerokuWebSecurityConfig extends WebSecurityConfigurerAdapter {
 
     @Override

src/main/java/org/owasp/wrongsecrets/canaries/TokenCallbackSecurityConfiguration.java

@@ -8,12 +8,11 @@
 
 @Configuration
 @EnableWebSecurity(debug = true)
-@Order(1)
+@Order(0)
 public class TokenCallbackSecurityConfiguration extends WebSecurityConfigurerAdapter {
 
     @Override
     protected void configure(HttpSecurity http) throws Exception {
-        http.authorizeRequests().requestMatchers(r -> r.getRequestURL().toString().contains("canaries")).permitAll()
-            .and().requestMatcher(r -> r.getRequestURL().toString().contains("canaries")).csrf().disable().httpBasic().disable().sessionManagement().disable();
+        http.requestMatcher(r -> r.getRequestURL().toString().contains("canaries")).csrf().disable();
     }
 }