SecurityConfig.java

package com.checkout.paymentgw.gateway.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.web.server.SecurityWebFilterChain;

@Configuration
@EnableWebFluxSecurity
public class SecurityConfig {

    /**
     * Production / staging / dev: validates a JWT bearer token against the configured
     * issuer (Cognito, Auth0, Okta, …). Issuer URI is set via
     * {@code spring.security.oauth2.resourceserver.jwt.issuer-uri}.
     */
    @Bean
    @Profile("!local")
    SecurityWebFilterChain secureChain(ServerHttpSecurity http) {
        return http
                .csrf(ServerHttpSecurity.CsrfSpec::disable)
                .authorizeExchange(ex -> ex
                        .pathMatchers("/actuator/**").permitAll()
                        .anyExchange().authenticated())
                .oauth2ResourceServer(oauth -> oauth.jwt(jwt -> {}))
                .build();
    }

    /**
     * Local profile: skip auth so {@code curl} examples in the README work.
     */
    @Bean
    @Profile("local")
    SecurityWebFilterChain localChain(ServerHttpSecurity http) {
        return http
                .csrf(ServerHttpSecurity.CsrfSpec::disable)
                .authorizeExchange(ex -> ex.anyExchange().permitAll())
                .build();
    }
}