Class AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequestMatcherRegistry
- Enclosing class:
- AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>
RequestMatcher
to an AuthorizationManager
.-
Nested Class Summary
Nested ClassesModifier and TypeClassDescriptionfinal class
A decorator class for registeringRequestMatcher
instances based on the type of servlet.final class
An object that allows configuring theAuthorizationManager
forRequestMatcher
s. -
Method Summary
Modifier and TypeMethodDescriptionand()
Deprecated, for removal: This API element is subject to removal in a future version.For removal in 7.0.protected AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl
chainRequestMatchers
(List<RequestMatcher> requestMatchers) Subclasses should implement this method for returning the object that is chained to the creation of theRequestMatcher
instances.forServletPattern
(String pattern, Customizer<AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry.AuthorizationManagerServletRequestMatcherRegistry> customizer) Begin registeringRequestMatcher
s based on the type of the servlet mapped topattern
.requestMatchers
(String... patterns) If theHandlerMappingIntrospector
is available in the classpath, maps to anMvcRequestMatcher
that does not care whichHttpMethod
is used.requestMatchers
(org.springframework.http.HttpMethod method) If theHandlerMappingIntrospector
is available in the classpath, maps to anMvcRequestMatcher
that matches on a specificHttpMethod
.requestMatchers
(org.springframework.http.HttpMethod method, String... patterns) If theHandlerMappingIntrospector
is available in the classpath, maps to anMvcRequestMatcher
that also specifies a specificHttpMethod
to match on.shouldFilterAllDispatcherTypes
(boolean shouldFilter) Deprecated, for removal: This API element is subject to removal in a future version.Permit access to theDispatcherType
instead.withObjectPostProcessor
(ObjectPostProcessor<?> objectPostProcessor) Adds anObjectPostProcessor
for this class.Methods inherited from class org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry
anyRequest, createMvcMatchers, dispatcherTypeMatchers, dispatcherTypeMatchers, getApplicationContext, requestMatchers, setApplicationContext
-
Method Details
-
chainRequestMatchers
protected AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl chainRequestMatchers(List<RequestMatcher> requestMatchers) Description copied from class:AbstractRequestMatcherRegistry
Subclasses should implement this method for returning the object that is chained to the creation of theRequestMatcher
instances.- Specified by:
chainRequestMatchers
in classAbstractRequestMatcherRegistry<AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizedUrl>
- Parameters:
requestMatchers
- theRequestMatcher
instances that were created- Returns:
- the chained Object for the subclass which allows association of something
else to the
RequestMatcher
-
forServletPattern
public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry forServletPattern(String pattern, Customizer<AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry.AuthorizationManagerServletRequestMatcherRegistry> customizer) Begin registeringRequestMatcher
s based on the type of the servlet mapped topattern
. Each registered request matcher will additionally checkHttpServletMapping.getPattern()
against the providedpattern
.If the corresponding servlet is of type
DispatcherServlet
, then use aAuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry.AuthorizationManagerServletRequestMatcherRegistry
that registersMvcRequestMatcher
s.Otherwise, use a configurer that registers
AntPathRequestMatcher
s.When doing a path-based pattern, like `/path/*`, registered URIs should leave out the matching path. For example, if the target URI is `/path/resource/3`, then the configuration should look like this:
.forServletPattern("/path/*", (path) -> path .requestMatchers("/resource/3").hasAuthority(...) )
Or, if the pattern is `/path/subpath/*`, and the URI is `/path/subpath/resource/3`, then the configuration should look like this:
.forServletPattern("/path/subpath/*", (path) -> path .requestMatchers("/resource/3").hasAuthority(...) )
For all other patterns, please supply the URI in absolute terms. For example, if the target URI is `/js/**` and it matches to the default servlet, then the configuration should look like this:
.forServletPattern("/", (root) -> root .requestMatchers("/js/**").hasAuthority(...) )
Or, if the target URI is `/views/**`, and it matches to a `*.jsp` extension servlet, then the configuration should look like this:
.forServletPattern("*.jsp", (jsp) -> jsp .requestMatchers("/views/**").hasAuthority(...) )
- Parameters:
customizer
- a customizer that uses aAuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry.AuthorizationManagerServletRequestMatcherRegistry
for URIs mapped to the provided servlet- Returns:
- an
AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry.AuthorizationManagerServletRequestMatcherRegistry
for further configurations - Since:
- 6.2
-
withObjectPostProcessor
public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry withObjectPostProcessor(ObjectPostProcessor<?> objectPostProcessor) Adds anObjectPostProcessor
for this class.- Parameters:
objectPostProcessor
- theObjectPostProcessor
to use- Returns:
- the
AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry
for further customizations
-
shouldFilterAllDispatcherTypes
@Deprecated(since="6.1", forRemoval=true) public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry shouldFilterAllDispatcherTypes(boolean shouldFilter) Deprecated, for removal: This API element is subject to removal in a future version.Permit access to theDispatcherType
instead.@Configuration @EnableWebSecurity public class SecurityConfig { @Bean public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { http .authorizeHttpRequests((authorize) -> authorize .dispatcherTypeMatchers(DispatcherType.ERROR).permitAll() // ... ); return http.build(); } }
Sets whether all dispatcher types should be filtered.- Parameters:
shouldFilter
- should filter all dispatcher types. Default istrue
- Returns:
- the
AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry
for further customizations - Since:
- 5.7
-
and
Deprecated, for removal: This API element is subject to removal in a future version.For removal in 7.0. Use the lambda based configuration instead.Return theHttpSecurityBuilder
when done using theAuthorizeHttpRequestsConfigurer
. This is useful for method chaining.- Returns:
- the
HttpSecurityBuilder
for further customizations
-
requestMatchers
Description copied from class:AbstractRequestMatcherRegistry
If the
HandlerMappingIntrospector
is available in the classpath, maps to anMvcRequestMatcher
that does not care whichHttpMethod
is used. This matcher will use the same rules that Spring MVC uses for matching. For example, often times a mapping of the path "/path" will match on "/path", "/path/", "/path.html", etc. If theHandlerMappingIntrospector
is not available, maps to anAntPathRequestMatcher
.If a specific
RequestMatcher
must be specified, useAbstractRequestMatcherRegistry.requestMatchers(RequestMatcher...)
instead- Overrides:
requestMatchers
in classAbstractRequestMatcherRegistry<C>
- Parameters:
patterns
- the patterns to match on. The rules for matching are defined by Spring MVC ifMvcRequestMatcher
is used- Returns:
- the object that is chained after creating the
RequestMatcher
.
-
requestMatchers
public final AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl requestMatchers(org.springframework.http.HttpMethod method, String... patterns) Description copied from class:AbstractRequestMatcherRegistry
If the
HandlerMappingIntrospector
is available in the classpath, maps to anMvcRequestMatcher
that also specifies a specificHttpMethod
to match on. This matcher will use the same rules that Spring MVC uses for matching. For example, often times a mapping of the path "/path" will match on "/path", "/path/", "/path.html", etc. If theHandlerMappingIntrospector
is not available, maps to anAntPathRequestMatcher
.If a specific
RequestMatcher
must be specified, useAbstractRequestMatcherRegistry.requestMatchers(RequestMatcher...)
instead- Overrides:
requestMatchers
in classAbstractRequestMatcherRegistry<C>
- Parameters:
method
- theHttpMethod
to use ornull
for anyHttpMethod
.patterns
- the patterns to match on. The rules for matching are defined by Spring MVC ifMvcRequestMatcher
is used- Returns:
- the object that is chained after creating the
RequestMatcher
.
-
requestMatchers
public final AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl requestMatchers(org.springframework.http.HttpMethod method) Description copied from class:AbstractRequestMatcherRegistry
If the
HandlerMappingIntrospector
is available in the classpath, maps to anMvcRequestMatcher
that matches on a specificHttpMethod
. This matcher will use the same rules that Spring MVC uses for matching. For example, often times a mapping of the path "/path" will match on "/path", "/path/", "/path.html", etc. If theHandlerMappingIntrospector
is not available, maps to anAntPathRequestMatcher
.If a specific
RequestMatcher
must be specified, useAbstractRequestMatcherRegistry.requestMatchers(RequestMatcher...)
instead- Overrides:
requestMatchers
in classAbstractRequestMatcherRegistry<C>
- Parameters:
method
- theHttpMethod
to use ornull
for anyHttpMethod
.- Returns:
- the object that is chained after creating the
RequestMatcher
.
-