Security

public String generateUserKey(Long personId, Long organisationId) {
  String data = personId + ":" + organisationId + ":" + System.currentTimeMillis();
  return Base64.getUrlEncoder().encodeToString(data.getBytes());
}

public String generateHash(String userKey) {
  return DigestUtils.md5Hex(SECRET_KEY + userKey);
}

public boolean verifyHash(String userKey, String providedHash) {
  String expectedHash = generateHash(userKey);
  return expectedHash.equals(providedHash);
}

export const membershipGuard: CanActivateFn = (route: ActivatedRouteSnapshot) => {
  const router = inject(Router);
  const membershipPeriodId = route.paramMap.get('membershipPeriodId');
  const pathUserKey = route.paramMap.get('u');
  const queryUserKey = route.queryParamMap.get('u');
  const userKey = pathUserKey || queryUserKey;
  const providedHash = route.queryParamMap.get('h');

  // Both userKey and hash must be present
  if (!userKey || !providedHash) {
    router.navigate(['/membership/register', membershipPeriodId], {
      queryParams: { error: 'Missing security verification parameters' }
    });
    return false;
  }

  // Verify hash
  const expectedHash = Md5.hashStr(SECRET_KEY + userKey);
  if (expectedHash !== providedHash) {
    router.navigate(['/membership/register', membershipPeriodId], {
      queryParams: { error: 'Invalid security verification' }
    });
    return false;
  }

  return true;
};

https://app.example.com/membership/register/42?u=abc123xyz&h=5d41402abc4b2a76b9719d911017c592

https://app.example.com/register?eventId=15&orgId=8&userKey=abc123xyz

@Injectable({ providedIn: 'root' })
export class SessionService {
  private userKeySubject = new BehaviorSubject<string>('');
  userKey$ = this.userKeySubject.asObservable();

  setUserKey(userKey: string): string {
    this.userKeySubject.next(userKey);
    sessionStorage.setItem('userKey', userKey);
    return userKey;
  }

  getUserKey(): string {
    return this.userKeySubject.value ||
           sessionStorage.getItem('userKey') || '';
  }

  getUserKey$(): Observable<string> {
    return this.userKey$;
  }
}

# Subdomain-based (production)
https://runningclub.myapp.com/membership/register/42?u=abc123&h=5d41...
→ Organization: "runningclub" (resolved via subdomain lookup)

# Path-based (alternative)
https://myapp.com/org/runningclub/membership/register/42?u=abc123&h=5d41...
→ Organization: "runningclub" (from path segment)

# Query parameter (development/testing)
https://localhost:4200/membership/register/42?orgId=8&u=abc123&h=5d41...
→ Organization ID: 8 (explicit)

# UserKey lookup (email/SMS links)
https://myapp.com/membership/register/42?u=abc123&h=5d41...
→ Organization ID: resolved from userKey "abc123" lookup

linkPerson(id: number, type: string, userKey: string): Observable<ILinkedPerson> {
  return this.http.post<ILinkedPerson>(
    `${this.linkEdPersonUrl}/${id}/${type}?userKey=${userKey}&organisationId=8`,
    { observe: 'response' }
  );
}

@PreAuthorize("hasPermission(#organisationId, 'Organisation', 'READ')")
public List<Person> getLinkedPersons(String userKey, Long organisationId) {
  // Query scoped to organisationId
  return personRepository.findByUserKeyAndOrganisation(userKey, organisationId);
}

public List<EmbeddedLinkedPersonDTO> getLinkedPersons(String userKey, Long orgId) {
  OrgUser orgUser = orgUserRepository.findByUserKey(userKey)
    .orElseThrow(() -> new EntityNotFoundException("OrgUser not found"));

  return linkedPersonRepository
    .findByPrincipalAndOrganisation(orgUser.getPerson(), orgId)
    .stream()
    .map(this::toDTO)
    .collect(Collectors.toList());
}

@Injectable({ providedIn: 'root' })
export class UserRouteAccessService {
  canActivate(route: ActivatedRouteSnapshot): boolean {
    const authorities = route.data['authorities'];

    if (!authorities || authorities.length === 0) {
      return true;
    }

    return this.accountService.hasAnyAuthority(authorities);
  }
}

{
  path: 'admin',
  component: AdminComponent,
  canActivate: [UserRouteAccessService],
  data: { authorities: ['ROLE_ADMIN'] }
}

@PreAuthorize("hasRole('ADMIN')")
public void deleteAllMemberships(Long organisationId) {
  membershipRepository.deleteByOrganisation(organisationId);
}

@PreAuthorize("@securityService.canAccessPerson(#personId, authentication)")
public Person updatePerson(Long personId, Person person) {
  return personRepository.save(person);
}

this.editForm = this.fb.group({
  firstName: ['', [
    Validators.required,
    Validators.minLength(2),
    Validators.maxLength(50),
    this.noSpecialCharactersValidator()
  ]],
  email: ['', [Validators.email, Validators.maxLength(254)]],
  identityNumber: ['', IDNumberService.validateIdentityNumber]
});

@Entity
public class Person {
  @NotNull
  @Size(min = 2, max = 50)
  @Pattern(regexp = "^[a-zA-Z\\s'-]+$")
  private String firstName;

  @Email
  @Size(max = 254)
  private String email;

  @Pattern(regexp = "^\\d{13}$")
  private String identityNumber;
}

@Configuration
public class SecurityConfiguration {
  @Bean
  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
      .csrf()
        .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
      .and()
      .authorizeHttpRequests()
        .requestMatchers("/api/**").authenticated();
    return http.build();
  }
}

export class CsrfInterceptor implements HttpInterceptor {
  intercept(req: HttpRequest<any>, next: HttpHandler):
    Observable<HttpEvent<any>> {
    const token = this.getCsrfToken();
    if (token) {
      req = req.clone({
        setHeaders: { 'X-XSRF-TOKEN': token }
      });
    }
    return next.handle(req);
  }
}

@Configuration
public class CorsConfiguration {
  @Bean
  public CorsFilter corsFilter() {
    UrlBasedCorsConfigurationSource source =
      new UrlBasedCorsConfigurationSource();

    CorsConfiguration config = new CorsConfiguration();
    config.setAllowCredentials(true);
    config.addAllowedOriginPattern("https://*.example.com");
    config.addAllowedHeader("*");
    config.addAllowedMethod("*");

    source.registerCorsConfiguration("/api/**", config);
    return new CorsFilter(source);
  }
}

server:
  ssl:
    enabled: true
    key-store: classpath:keystore.p12
    key-store-password: ${SSL_KEY_STORE_PASSWORD}
    key-store-type: PKCS12

{
  "timestamp": "2024-01-31T10:15:30Z",
  "level": "WARN",
  "event": "INVALID_USER_KEY",
  "userKey": "abc123xyz",
  "providedHash": "invalid_hash",
  "ip": "192.168.1.100",
  "userAgent": "Mozilla/5.0 ..."
}