Package org.springframework.security.web.access.expression

Class WebExpressionAuthorizationManager

java.lang.Object

org.springframework.security.web.access.expression.WebExpressionAuthorizationManager

All Implemented Interfaces:

AuthorizationManager<RequestAuthorizationContext>

public final class WebExpressionAuthorizationManager
extends Object
implements AuthorizationManager<RequestAuthorizationContext>

An expression-based AuthorizationManager that determines the access by evaluating the provided expression.

Since:

5.8

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	WebExpressionAuthorizationManager.Builder	A WebExpressionAuthorizationManager.Builder for constructing WebExpressionAuthorizationManager instances.

Constructor Summary

Constructors

Constructor	Description
WebExpressionAuthorizationManager(String expressionString)	Creates an instance.

Method Summary

Modifier and Type	Method	Description
AuthorizationResult	authorize(Supplier<? extends @Nullable Authentication> authentication, RequestAuthorizationContext context)	Determines the access by evaluating the provided expression.
void	setExpressionHandler(SecurityExpressionHandler<RequestAuthorizationContext> expressionHandler)	Deprecated. Please use withDefaults() or withExpressionHandler(org.springframework.security.access.expression.SecurityExpressionHandler<org.springframework.security.web.access.intercept.RequestAuthorizationContext>)
String	toString()
static WebExpressionAuthorizationManager.Builder	withDefaults()	Use a DefaultHttpSecurityExpressionHandler to create WebExpressionAuthorizationManager instances.
static WebExpressionAuthorizationManager.Builder	withExpressionHandler(SecurityExpressionHandler<RequestAuthorizationContext> expressionHandler)	Use this SecurityExpressionHandler to create WebExpressionAuthorizationManager instances

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface org.springframework.security.authorization.AuthorizationManager

verify

Constructor Details

WebExpressionAuthorizationManager

public WebExpressionAuthorizationManager(String expressionString)

Creates an instance.

Parameters:

expressionString - the raw expression string to parse

Method Details

setExpressionHandler

@Deprecated
public void setExpressionHandler(SecurityExpressionHandler<RequestAuthorizationContext> expressionHandler)

Deprecated.

Please use withDefaults() or withExpressionHandler(org.springframework.security.access.expression.SecurityExpressionHandler<org.springframework.security.web.access.intercept.RequestAuthorizationContext>)

Sets the SecurityExpressionHandler to be used. The default is DefaultHttpSecurityExpressionHandler.

Parameters:

expressionHandler - the SecurityExpressionHandler to use

authorize

public AuthorizationResult authorize(Supplier<? extends @Nullable Authentication> authentication,
 RequestAuthorizationContext context)

Determines the access by evaluating the provided expression.

Specified by:

authorize in interface AuthorizationManager<RequestAuthorizationContext>

Parameters:

authentication - the Supplier of the Authentication to check

context - the RequestAuthorizationContext to check

Returns:

an ExpressionAuthorizationDecision based on the evaluated expression

toString

public String toString()

Overrides:

toString in class Object

withDefaults

public static WebExpressionAuthorizationManager.Builder withDefaults()

Use a DefaultHttpSecurityExpressionHandler to create WebExpressionAuthorizationManager instances.

Note that publishing the WebExpressionAuthorizationManager.Builder as a bean will allow the default expression handler to be configured with a bean provider so that expressions can reference beans

Returns:

a WebExpressionAuthorizationManager.Builder for constructing WebExpressionAuthorizationManager instances

Since:

7.0

withExpressionHandler

public static WebExpressionAuthorizationManager.Builder withExpressionHandler(SecurityExpressionHandler<RequestAuthorizationContext> expressionHandler)

Use this SecurityExpressionHandler to create WebExpressionAuthorizationManager instances

Parameters:

expressionHandler -

Returns:

a WebExpressionAuthorizationManager.Builder for constructing WebExpressionAuthorizationManager instances

Since:

7.0