From a4a8b551b0b91cc1d3733549ee887ac6aa8e007d Mon Sep 17 00:00:00 2001
From: sdw086 <sdw086@gmail.com>
Date: Mon, 11 May 2026 09:50:12 +0900
Subject: [PATCH] =?UTF-8?q?[api]=20=ED=8C=8C=EC=9D=BC=EC=97=85=EB=A1=9C?=
 =?UTF-8?q?=EB=93=9C=20=EA=B3=B5=EA=B0=9C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../com/alist/api/config/SecurityConfig.java    | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/main/java/com/alist/api/config/SecurityConfig.java b/src/main/java/com/alist/api/config/SecurityConfig.java
index 6e92219..d5af29a 100644
--- a/src/main/java/com/alist/api/config/SecurityConfig.java
+++ b/src/main/java/com/alist/api/config/SecurityConfig.java
@@ -59,7 +59,10 @@ public class SecurityConfig {
 				.cors(Customizer.withDefaults())
 				.csrf(csrf -> csrf.disable())
 				.authorizeHttpRequests(auth -> auth
-						.requestMatchers("/admin/auth/**").permitAll()
+						.requestMatchers(
+								"/admin/auth/**"
+								, "/admin/files/**"
+						).permitAll()
 						.anyRequest().hasRole("ADMIN")
 				)
 				.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
@@ -78,7 +81,17 @@ public class SecurityConfig {
 						.accessDeniedHandler(new JwtAccessDeniedHandler())
 				)
 				.authorizeHttpRequests(auth -> auth
-						.requestMatchers("/", "/actuator/health", "/sso/**", "/auth/**", "/user/signup", "/user/migrationUserList", "/tusFiles/tusHook", "/tusFiles/uploadAuth").permitAll()
+						.requestMatchers(
+								"/"
+								, "/actuator/health"
+								, "/sso/**"
+								, "/auth/**"
+								, "/user/signup"
+								, "/user/migrationUserList"
+								, "/tusFiles/tusHook"
+								, "/tusFiles/uploadAuth"
+								, "/files/**"
+						).permitAll()
 						.anyRequest().authenticated()
 				)
 				.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);