Package org.springframework.security.config.annotation.web.configurers

Class AuthorizeHttpRequestsConfigurer.AuthorizedUrl

java.lang.Object

org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer.AuthorizedUrl

Enclosing class:

AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>

public class AuthorizeHttpRequestsConfigurer.AuthorizedUrl
extends Object

An object that allows configuring the AuthorizationManager for RequestMatchers.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
final class	AuthorizeHttpRequestsConfigurer.AuthorizedUrl.AuthorizedUrlVariable	An object that allows configuring RequestMatchers with URI path variables

Method Summary

Modifier and Type	Method	Description
AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry	access(AuthorizationManager<RequestAuthorizationContext> manager)	Allows specifying a custom AuthorizationManager.
AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry	anonymous()	Specify that URLs are allowed by anonymous users.
AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry	authenticated()	Specify that URLs are allowed by any authenticated user.
AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry	denyAll()	Specify that URLs are not allowed by anyone.
AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry	fullyAuthenticated()	Specify that URLs are allowed by users who have authenticated and were not "remembered".
protected List<? extends RequestMatcher>	getMatchers()
AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry	hasAnyAuthority(String... authorities)	Specifies that a user requires one of many authorities.
AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry	hasAnyRole(String... roles)	Specifies that a user requires one of many roles.
AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry	hasAuthority(String authority)	Specifies a user requires an authority.
AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry	hasRole(String role)	Specifies a user requires a role.
AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl.AuthorizedUrlVariable	hasVariable(String variable)	Specify that a path variable in URL to be compared.
AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl	not()	Negates the following authorization rule.
AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry	permitAll()	Specify that URLs are allowed by anyone.
AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry	rememberMe()	Specify that URLs are allowed by users that have been remembered.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

getMatchers

protected List<? extends RequestMatcher> getMatchers()

not

public AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl not()

Negates the following authorization rule.

Returns:

the AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizedUrl for further customization

Since:

6.3

permitAll

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry permitAll()

Specify that URLs are allowed by anyone.

Returns:

the AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry for further customizations

denyAll

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry denyAll()

Specify that URLs are not allowed by anyone.

Returns:

the AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry for further customizations

hasRole

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry hasRole(String role)

Specifies a user requires a role.

Parameters:

role - the role that should be required which is prepended with ROLE_ automatically (i.e. USER, ADMIN, etc). It should not start with ROLE_

Returns:

AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry for further customizations

hasAnyRole

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry hasAnyRole(String... roles)

Specifies that a user requires one of many roles.

Parameters:

roles - the roles that the user should have at least one of (i.e. ADMIN, USER, etc). Each role should not start with ROLE_ since it is automatically prepended already

Returns:

the AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry for further customizations

hasAuthority

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry hasAuthority(String authority)

Specifies a user requires an authority.

Parameters:

authority - the authority that should be required

Returns:

the AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry for further customizations

hasAnyAuthority

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry hasAnyAuthority(String... authorities)

Specifies that a user requires one of many authorities.

Parameters:

authorities - the authorities that the user should have at least one of (i.e. ROLE_USER, ROLE_ADMIN, etc)

Returns:

the AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry for further customizations

authenticated

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry authenticated()

Specify that URLs are allowed by any authenticated user.

Returns:

the AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry for further customizations

fullyAuthenticated

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry fullyAuthenticated()

Specify that URLs are allowed by users who have authenticated and were not "remembered".

Returns:

the AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry for further customization

Since:

5.8

See Also:

• RememberMeConfigurer

rememberMe

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry rememberMe()

Specify that URLs are allowed by users that have been remembered.

Returns:

the AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry for further customization

Since:

5.8

See Also:

• RememberMeConfigurer

anonymous

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry anonymous()

Specify that URLs are allowed by anonymous users.

Returns:

the AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry for further customization

Since:

5.8

hasVariable

public AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl.AuthorizedUrlVariable hasVariable(String variable)

Specify that a path variable in URL to be compared.

For example,

 requestMatchers("/user/{username}").hasVariable("username").equalTo(Authentication::getName)
 

Parameters:

variable - the variable in URL template to compare.

Returns:

AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizedUrl.AuthorizedUrlVariable for further customization.

Since:

6.3

access

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry access(AuthorizationManager<RequestAuthorizationContext> manager)

Allows specifying a custom AuthorizationManager.

Parameters:

manager - the AuthorizationManager to use

Returns:

the AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry for further customizations