Package org.springframework.security.config.annotation.web.configurers

Class ExpressionUrlAuthorizationConfigurer.AuthorizedUrl

java.lang.Object

org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer.AuthorizedUrl

Enclosing class:

ExpressionUrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>

public class ExpressionUrlAuthorizationConfigurer.AuthorizedUrl
extends Object

Method Summary

Modifier and Type	Method	Description
ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry	access(String attribute)	Allows specifying that URLs are secured by an arbitrary expression
ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry	anonymous()	Specify that URLs are allowed by anonymous users.
ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry	authenticated()	Specify that URLs are allowed by any authenticated user.
ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry	denyAll()	Specify that URLs are not allowed by anyone.
ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry	fullyAuthenticated()	Specify that URLs are allowed by users who have authenticated and were not "remembered".
protected List<? extends RequestMatcher>	getMatchers()
ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry	hasAnyAuthority(String... authorities)	Specify that URLs requires any of a number authorities.
ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry	hasAnyRole(String... roles)	Shortcut for specifying URLs require any of a number of roles.
ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry	hasAuthority(String authority)	Specify that URLs require a particular authority.
ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry	hasIpAddress(String ipaddressExpression)	Specify that URLs requires a specific IP Address or subnet.
ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry	hasRole(String role)	Shortcut for specifying URLs require a particular role.
ExpressionUrlAuthorizationConfigurer<H>.AuthorizedUrl	not()	Negates the following expression.
ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry	permitAll()	Specify that URLs are allowed by anyone.
ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry	rememberMe()	Specify that URLs are allowed by users that have been remembered.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

getMatchers

protected List<? extends RequestMatcher> getMatchers()

not

public ExpressionUrlAuthorizationConfigurer<H>.AuthorizedUrl not()

Negates the following expression.

Returns:

the ExpressionUrlAuthorizationConfigurer for further customization

hasRole

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry hasRole(String role)

Shortcut for specifying URLs require a particular role. If you do not want to have role prefix (default "ROLE_") automatically inserted see hasAuthority(String).

Parameters:

role - the role to require (i.e. USER, ADMIN, etc). Note, it should not start with role prefix as this is automatically inserted.

Returns:

the ExpressionUrlAuthorizationConfigurer for further customization

hasAnyRole

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry hasAnyRole(String... roles)

Shortcut for specifying URLs require any of a number of roles. If you do not want to have role prefix (default "ROLE_") automatically inserted see hasAnyAuthority(String...)

Parameters:

roles - the roles to require (i.e. USER, ADMIN, etc). Note, it should not start with role prefix as this is automatically inserted.

Returns:

the ExpressionUrlAuthorizationConfigurer for further customization

hasAuthority

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry hasAuthority(String authority)

Specify that URLs require a particular authority.

Parameters:

authority - the authority to require (i.e. ROLE_USER, ROLE_ADMIN, etc).

Returns:

the ExpressionUrlAuthorizationConfigurer for further customization

hasAnyAuthority

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry hasAnyAuthority(String... authorities)

Specify that URLs requires any of a number authorities.

Parameters:

authorities - the requests require at least one of the authorities (i.e. "ROLE_USER","ROLE_ADMIN" would mean either "ROLE_USER" or "ROLE_ADMIN" is required).

Returns:

the ExpressionUrlAuthorizationConfigurer for further customization

hasIpAddress

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry hasIpAddress(String ipaddressExpression)

Specify that URLs requires a specific IP Address or subnet.

Parameters:

ipaddressExpression - the ipaddress (i.e. 192.168.1.79) or local subnet (i.e. 192.168.0/24)

Returns:

the ExpressionUrlAuthorizationConfigurer for further customization

permitAll

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry permitAll()

Specify that URLs are allowed by anyone.

Returns:

the ExpressionUrlAuthorizationConfigurer for further customization

anonymous

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry anonymous()

Specify that URLs are allowed by anonymous users.

Returns:

the ExpressionUrlAuthorizationConfigurer for further customization

rememberMe

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry rememberMe()

Specify that URLs are allowed by users that have been remembered.

Returns:

the ExpressionUrlAuthorizationConfigurer for further customization

See Also:

• RememberMeConfigurer

denyAll

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry denyAll()

Specify that URLs are not allowed by anyone.

Returns:

the ExpressionUrlAuthorizationConfigurer for further customization

authenticated

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry authenticated()

Specify that URLs are allowed by any authenticated user.

Returns:

the ExpressionUrlAuthorizationConfigurer for further customization

fullyAuthenticated

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry fullyAuthenticated()

Specify that URLs are allowed by users who have authenticated and were not "remembered".

Returns:

the ExpressionUrlAuthorizationConfigurer for further customization

See Also:

• RememberMeConfigurer

access

public ExpressionUrlAuthorizationConfigurer<H>.ExpressionInterceptUrlRegistry access(String attribute)

Allows specifying that URLs are secured by an arbitrary expression

Parameters:

attribute - the expression to secure the URLs (i.e. "hasRole('ROLE_USER') and hasRole('ROLE_SUPER')")

Returns:

the ExpressionUrlAuthorizationConfigurer for further customization