Package org.springframework.security.config.annotation.web.configurers

Class UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>

  • Type Parameters:
    H - the type of HttpSecurityBuilder that is being configured
    All Implemented Interfaces:
    SecurityConfigurer<org.springframework.security.web.DefaultSecurityFilterChain,​H>
    public final class UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>
extends AbstractInterceptUrlConfigurer<UrlAuthorizationConfigurer<H>,​H>
    Adds URL based authorization using DefaultFilterInvocationSecurityMetadataSource. At least one RequestMapping needs to be mapped to ConfigAttribute's for this SecurityContextConfigurer to have meaning.

    Security Filters

    Usage includes applying the UrlAuthorizationConfigurer and then modifying the StandardInterceptUrlRegistry. For example: 

     @Bean
 public SecurityFilterChain filterChain(HttpSecurity http, ApplicationContext context) throws Exception {
        http.apply(new UrlAuthorizationConfigurer<HttpSecurity>(context)).getRegistry()
                        .requestMatchers("/users**", "/sessions/**").hasRole("USER")
                        .requestMatchers("/signup").hasRole("ANONYMOUS").anyRequest().hasRole("USER");
 }
    The following Filters are populated
    • FilterSecurityInterceptor

    Shared Objects Created

    The following shared objects are populated to allow other SecurityConfigurer's to customize:
    • FilterSecurityInterceptor

    Shared Objects Used

    The following shared objects are used:
    • AuthenticationManager
    Since:
    3.2
    See Also:
    ExpressionUrlAuthorizationConfigurer