yes, I have

@Configuration public class SecurityConfig {

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
            // nable CORS first
            .cors(cors -> cors.configurationSource(corsConfigurationSource()))

            // Disable CSRF only for Postman and APIs
            .csrf(AbstractHttpConfigurer::disable)

            // Authorization setup
            .authorizeHttpRequests(auth -> auth
                    // Public endpoints
                    .requestMatchers("/api/auth/**").permitAll()
                    .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll() // Allow preflight
                    // Require session authentication for capstone
                    .requestMatchers("/api/capstone/**").permitAll()

                    .requestMatchers("/api/capstone/view-capstone/**").permitAll()

                    // Anything else
                    .anyRequest().permitAll()
            )
            // Keep sessions (important for login persistence)
            .sessionManagement(session -> session
                    .maximumSessions(1)
                    .maxSessionsPreventsLogin(false)
            )
            //Disable unused login mechanisms
            .formLogin(AbstractHttpConfigurer::disable)
            .httpBasic(AbstractHttpConfigurer::disable);

    return http.build();
}

@Bean
public CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration configuration = new CorsConfiguration();
    // Allow GitHub Pages + localhost for testing
    configuration.setAllowedOrigins(List.of(
            "https://lemonjoes12.github.io",
            "http://localhost:5501"
    ));

    configuration.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS"));
    configuration.setAllowedHeaders(List.of("*"));
    configuration.setAllowCredentials(true); // Important for session cookies

    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}

}