Package org.springframework.security.config.annotation.web.configurers

Class AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequestMatcherRegistry

java.lang.Object

org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry<C>

org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequestMatcherRegistry

Enclosing class:

AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>

public final class AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequestMatcherRegistry
extends AbstractRequestMatcherRegistry<C>

Registry for mapping a RequestMatcher to an AuthorizationManager.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
final class	AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequestMatcherRegistry.AuthorizationManagerServletRequestMatcherRegistry	A decorator class for registering RequestMatcher instances based on the type of servlet.
final class	AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequestMatcherRegistry.ServletAuthorizedUrl	An object that allows configuring the AuthorizationManager for RequestMatchers.

Method Summary

Modifier and Type	Method	Description
H	and()	Deprecated, for removal: This API element is subject to removal in a future version. For removal in 7.0.
protected AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl	chainRequestMatchers(List<RequestMatcher> requestMatchers)	Subclasses should implement this method for returning the object that is chained to the creation of the RequestMatcher instances.
AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry	forServletPattern(String pattern, Customizer<AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry.AuthorizationManagerServletRequestMatcherRegistry> customizer)	Begin registering RequestMatchers based on the type of the servlet mapped to pattern.
final AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl	requestMatchers(String... patterns)	If the HandlerMappingIntrospector is available in the classpath, maps to an MvcRequestMatcher that does not care which HttpMethod is used.
final AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl	requestMatchers(org.springframework.http.HttpMethod method)	If the HandlerMappingIntrospector is available in the classpath, maps to an MvcRequestMatcher that matches on a specific HttpMethod.
final AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl	requestMatchers(org.springframework.http.HttpMethod method, String... patterns)	If the HandlerMappingIntrospector is available in the classpath, maps to an MvcRequestMatcher that also specifies a specific HttpMethod to match on.
AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry	shouldFilterAllDispatcherTypes(boolean shouldFilter)	Deprecated, for removal: This API element is subject to removal in a future version. Permit access to the DispatcherType instead.
AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry	withObjectPostProcessor(ObjectPostProcessor<?> objectPostProcessor)	Adds an ObjectPostProcessor for this class.

Methods inherited from class org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry

anyRequest, createMvcMatchers, dispatcherTypeMatchers, dispatcherTypeMatchers, getApplicationContext, requestMatchers, setApplicationContext

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

chainRequestMatchers

protected AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl chainRequestMatchers(List<RequestMatcher> requestMatchers)

Description copied from class: AbstractRequestMatcherRegistry

Subclasses should implement this method for returning the object that is chained to the creation of the RequestMatcher instances.

Specified by:

chainRequestMatchers in class AbstractRequestMatcherRegistry<AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizedUrl>

Parameters:

requestMatchers - the RequestMatcher instances that were created

Returns:

the chained Object for the subclass which allows association of something else to the RequestMatcher

forServletPattern

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry forServletPattern(String pattern,
 Customizer<AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry.AuthorizationManagerServletRequestMatcherRegistry> customizer)

Begin registering RequestMatchers based on the type of the servlet mapped to pattern. Each registered request matcher will additionally check HttpServletMapping.getPattern() against the provided pattern.

If the corresponding servlet is of type DispatcherServlet, then use a AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry.AuthorizationManagerServletRequestMatcherRegistry that registers MvcRequestMatchers.

Otherwise, use a configurer that registers AntPathRequestMatchers.

When doing a path-based pattern, like `/path/*`, registered URIs should leave out the matching path. For example, if the target URI is `/path/resource/3`, then the configuration should look like this: .forServletPattern("/path/*", (path) -> path .requestMatchers("/resource/3").hasAuthority(...) )

Or, if the pattern is `/path/subpath/*`, and the URI is `/path/subpath/resource/3`, then the configuration should look like this: .forServletPattern("/path/subpath/*", (path) -> path .requestMatchers("/resource/3").hasAuthority(...) )

For all other patterns, please supply the URI in absolute terms. For example, if the target URI is `/js/**` and it matches to the default servlet, then the configuration should look like this: .forServletPattern("/", (root) -> root .requestMatchers("/js/**").hasAuthority(...) )

Or, if the target URI is `/views/**`, and it matches to a `*.jsp` extension servlet, then the configuration should look like this: .forServletPattern("*.jsp", (jsp) -> jsp .requestMatchers("/views/**").hasAuthority(...) )

Parameters:

customizer - a customizer that uses a AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry.AuthorizationManagerServletRequestMatcherRegistry for URIs mapped to the provided servlet

Returns:

an AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry.AuthorizationManagerServletRequestMatcherRegistry for further configurations

Since:

6.2

withObjectPostProcessor

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry withObjectPostProcessor(ObjectPostProcessor<?> objectPostProcessor)

Adds an ObjectPostProcessor for this class.

Parameters:

objectPostProcessor - the ObjectPostProcessor to use

Returns:

the AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry for further customizations

shouldFilterAllDispatcherTypes

@Deprecated(since="6.1",
            forRemoval=true)
public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry shouldFilterAllDispatcherTypes(boolean shouldFilter)

Deprecated, for removal: This API element is subject to removal in a future version.

Permit access to the DispatcherType instead.

 @Configuration
 @EnableWebSecurity
 public class SecurityConfig {

        @Bean
        public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
                http
                        .authorizeHttpRequests((authorize) -> authorize
                                .dispatcherTypeMatchers(DispatcherType.ERROR).permitAll()
                                // ...
                        );
                return http.build();
        }
 }
 

Sets whether all dispatcher types should be filtered.

Parameters:

shouldFilter - should filter all dispatcher types. Default is true

Returns:

the AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry for further customizations

Since:

5.7

and

@Deprecated(since="6.1",
            forRemoval=true)
public H and()

Deprecated, for removal: This API element is subject to removal in a future version.

For removal in 7.0. Use the lambda based configuration instead.

Return the HttpSecurityBuilder when done using the AuthorizeHttpRequestsConfigurer. This is useful for method chaining.

Returns:

the HttpSecurityBuilder for further customizations

requestMatchers

public final AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl requestMatchers(String... patterns)

Description copied from class: AbstractRequestMatcherRegistry

If the HandlerMappingIntrospector is available in the classpath, maps to an MvcRequestMatcher that does not care which HttpMethod is used. This matcher will use the same rules that Spring MVC uses for matching. For example, often times a mapping of the path "/path" will match on "/path", "/path/", "/path.html", etc. If the HandlerMappingIntrospector is not available, maps to an AntPathRequestMatcher.

If a specific RequestMatcher must be specified, use AbstractRequestMatcherRegistry.requestMatchers(RequestMatcher...) instead

Overrides:

requestMatchers in class AbstractRequestMatcherRegistry<C>

Parameters:

patterns - the patterns to match on. The rules for matching are defined by Spring MVC if MvcRequestMatcher is used

Returns:

the object that is chained after creating the RequestMatcher.

requestMatchers

public final AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl requestMatchers(org.springframework.http.HttpMethod method,
 String... patterns)

Description copied from class: AbstractRequestMatcherRegistry

If the HandlerMappingIntrospector is available in the classpath, maps to an MvcRequestMatcher that also specifies a specific HttpMethod to match on. This matcher will use the same rules that Spring MVC uses for matching. For example, often times a mapping of the path "/path" will match on "/path", "/path/", "/path.html", etc. If the HandlerMappingIntrospector is not available, maps to an AntPathRequestMatcher.

If a specific RequestMatcher must be specified, use AbstractRequestMatcherRegistry.requestMatchers(RequestMatcher...) instead

Overrides:

requestMatchers in class AbstractRequestMatcherRegistry<C>

Parameters:

method - the HttpMethod to use or null for any HttpMethod.

patterns - the patterns to match on. The rules for matching are defined by Spring MVC if MvcRequestMatcher is used

Returns:

the object that is chained after creating the RequestMatcher.

requestMatchers

public final AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl requestMatchers(org.springframework.http.HttpMethod method)

Description copied from class: AbstractRequestMatcherRegistry

If the HandlerMappingIntrospector is available in the classpath, maps to an MvcRequestMatcher that matches on a specific HttpMethod. This matcher will use the same rules that Spring MVC uses for matching. For example, often times a mapping of the path "/path" will match on "/path", "/path/", "/path.html", etc. If the HandlerMappingIntrospector is not available, maps to an AntPathRequestMatcher.

If a specific RequestMatcher must be specified, use AbstractRequestMatcherRegistry.requestMatchers(RequestMatcher...) instead

Overrides:

requestMatchers in class AbstractRequestMatcherRegistry<C>

Parameters:

method - the HttpMethod to use or null for any HttpMethod.

Returns:

the object that is chained after creating the RequestMatcher.