org.springframework.security.config.annotation.web.configurers

Class UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>

java.lang.Object

org.springframework.security.config.annotation.SecurityConfigurerAdapter<DefaultSecurityFilterChain,B>

org.springframework.security.config.annotation.web.configurers.UrlAuthorizationConfigurer<H>

Type Parameters:

H - the type of HttpSecurityBuilder that is being configured

C - the type of object that is being chained

All Implemented Interfaces:

SecurityConfigurer<DefaultSecurityFilterChain,H>

public final class UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>
extends SecurityConfigurerAdapter<DefaultSecurityFilterChain,B>

Adds URL based authorization using DefaultFilterInvocationSecurityMetadataSource. At least one RequestMapping needs to be mapped to ConfigAttribute's for this SecurityContextConfigurer to have meaning.

Security Filters

Usage includes applying the UrlAuthorizationConfigurer and then modifying the StandardInterceptUrlRegistry. For example:

 protected void configure(HttpSecurity http) throws Exception {
     http
          .apply(new UrlAuthorizationConfigurer()).getRegistry()
              .antMatchers("/users**","/sessions/**").hasRole("USER")
              .antMatchers("/signup").hasRole("ANONYMOUS")
              .anyRequest().hasRole("USER");
 }
 

The following Filters are populated

• FilterSecurityInterceptor

Shared Objects Created

The following shared objects are populated to allow other SecurityConfigurer's to customize:

• FilterSecurityInterceptor

Shared Objects Used

The following shared objects are used:

• org.springframework.security.config.annotation.web.builders.HttpSecurity#getAuthenticationManager()

Since:

3.2

See Also:

ExpressionUrlAuthorizationConfigurer

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
class	UrlAuthorizationConfigurer.AuthorizedUrl Maps the specified RequestMatcher instances to ConfigAttribute instances.
class	UrlAuthorizationConfigurer.StandardInterceptUrlRegistry

Constructor Summary

Constructors

Constructor and Description
UrlAuthorizationConfigurer()

Method Summary

Methods

Modifier and Type	Method and Description
void	configure(H http) Configure the SecurityBuilder by setting the necessary properties on the SecurityBuilder.
B	disable() Disables the AbstractHttpConfigurer by removing it.
UrlAuthorizationConfigurer.StandardInterceptUrlRegistry	getRegistry() The StandardInterceptUrlRegistry is what users will interact with after applying the UrlAuthorizationConfigurer.
UrlAuthorizationConfigurer<H>	withObjectPostProcessor(ObjectPostProcessor<?> objectPostProcessor) Adds an ObjectPostProcessor for this class.

Methods inherited from class org.springframework.security.config.annotation.SecurityConfigurerAdapter

addObjectPostProcessor, and, getBuilder, init, postProcess, setBuilder

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

UrlAuthorizationConfigurer

public UrlAuthorizationConfigurer()

Method Detail

getRegistry

public UrlAuthorizationConfigurer.StandardInterceptUrlRegistry getRegistry()

The StandardInterceptUrlRegistry is what users will interact with after applying the UrlAuthorizationConfigurer.

Returns:

withObjectPostProcessor

public UrlAuthorizationConfigurer<H> withObjectPostProcessor(ObjectPostProcessor<?> objectPostProcessor)

Adds an ObjectPostProcessor for this class.

Parameters:

objectPostProcessor -

Returns:

the UrlAuthorizationConfigurer for further customizations

configure

public void configure(H http)
               throws Exception

Description copied from interface: SecurityConfigurer

Configure the SecurityBuilder by setting the necessary properties on the SecurityBuilder.

Specified by:

configure in interface SecurityConfigurer<DefaultSecurityFilterChain,H extends HttpSecurityBuilder<H>>

Overrides:

configure in class SecurityConfigurerAdapter<DefaultSecurityFilterChain,H extends HttpSecurityBuilder<H>>

Throws:

Exception

disable

public B disable()

Disables the AbstractHttpConfigurer by removing it. After doing so a fresh version of the configuration can be applied.

Returns:

the HttpSecurityBuilder for additional customizations