spring-security-config/org.springframework.security.config.annotation.web/AuthorizeHttpRequestsDsl

AuthorizeHttpRequestsDsl

class AuthorizeHttpRequestsDsl : AbstractRequestMatcherDsl

A Kotlin DSL to configure HttpSecurity request authorization using idiomatic Kotlin code.

Author

Yuriy Savchenko

Since

5.7

Constructors

AuthorizeHttpRequestsDsl

constructor(context: ApplicationContext)

Properties

anyRequest

val anyRequest: RequestMatcher

Matches any request.

authenticated

val authenticated: AuthorizationManager<in RequestAuthorizationContext>

Specify that URLs are allowed by any authenticated user.

denyAll

val denyAll: AuthorizationManager<in RequestAuthorizationContext>

Specify that URLs are not allowed by anyone.

fullyAuthenticated

val fullyAuthenticated: AuthorizationManager<in RequestAuthorizationContext>

Specify that URLs are allowed by users who have authenticated and were not "remembered".

permitAll

val permitAll: AuthorizationManager<in RequestAuthorizationContext>

Specify that URLs are allowed by anyone.

Functions

authorize

fun authorize(pattern: String, access: AuthorizationManager<in RequestAuthorizationContext>)

fun authorize(pattern: String, servletPath: String, access: AuthorizationManager<in RequestAuthorizationContext>)

fun authorize(method: HttpMethod, pattern: String, access: AuthorizationManager<in RequestAuthorizationContext>)

fun authorize(method: HttpMethod, pattern: String, servletPath: String, access: AuthorizationManager<in RequestAuthorizationContext>)

Adds a request authorization rule for an endpoint matching the provided pattern. If Spring MVC is on the classpath, it will use an MVC matcher. If Spring MVC is not on the classpath, it will use an ant matcher. The MVC will use the same rules that Spring MVC uses for matching. For example, often times a mapping of the path "/path" will match on "/path", "/path/", "/path.html", etc. If the current request will not be processed by Spring MVC, a reasonable default using the pattern as an ant pattern will be used.

fun authorize(matches: RequestMatcher = AnyRequestMatcher.INSTANCE, access: AuthorizationManager<in RequestAuthorizationContext>)

Adds a request authorization rule.

hasAllAuthorities

fun hasAllAuthorities(vararg authorities: String): AuthorizationManager<in RequestAuthorizationContext>

Specify that URLs require any of the provided authorities.

hasAllRoles

fun hasAllRoles(vararg roles: String): AuthorizationManager<in RequestAuthorizationContext>

Specify that URLs require any of the provided roles.

hasAnyAuthority

fun hasAnyAuthority(vararg authorities: String): AuthorizationManager<in RequestAuthorizationContext>

Specify that URLs require any of the provided authorities.

hasAnyRole

fun hasAnyRole(vararg roles: String): AuthorizationManager<in RequestAuthorizationContext>

Specify that URLs require any of the provided roles.

hasAuthority

fun hasAuthority(authority: String): AuthorizationManager<in RequestAuthorizationContext>

Specify that URLs require a particular authority.

hasIpAddress

fun hasIpAddress(ipAddress: String): AuthorizationManager<RequestAuthorizationContext>

Require a specific IP or range of IP addresses.

hasRole

fun hasRole(role: String): AuthorizationManager<in RequestAuthorizationContext>

Specify that URLs require a particular role.