CODEWITHSUNDEEP
springspring-security
Nikolay
Nikolay

Reputation: 81

Order of intercept-url patterns in Spring Security

In appSecurity.xml I have this:

intercept-url pattern="/users/profile/**" access="hasRole('VIEW_PROFILES')".

intercept-url pattern="/users/profile/edit/**" access="hasRole('EDIT_PROFILES')"

I have a page /users/profiles/edit/addnew and when user with role VIEW_PROFILES is trying to access this page, he gets it successfully but the access to user with role EDIT_PROFILES is blocked.

What I'm doing wrong?

Upvotes: 4

Views: 8172

Answers (3)

Ritesh
Ritesh

Reputation: 7522

Since "/users/profile/edit/" is more specific than "/users/profile/", it should be placed higher in the list.

Why

Patterns are always evaluated in the order they are defined. Thus it is important that more specific patterns are defined higher in the list than less specific patterns. This is reflected in our example above, where the more specific /secure/super/ pattern appears higher than the less specific /secure/ pattern. If they were reversed, the /secure/ pattern would always match and the /secure/super/ pattern would never be evaluated.

Source: Core Security Filters

Upvotes: 11

cabbagery
cabbagery

Reputation: 919

Both John Farrelly and Ritesh are correct. The intercept-url patterns are matched in the order listed. As soon as a match is found, the rest of the patterns specified are ignored. This is why you should list more specific patterns earlier.

In your case, the pattern for /users/profile/edit/somepage matches the pattern specified in the first intercept-url pattern, so Spring is appropriately checking to see if the user in question has the access role specified. Apparently, your EDIT_PROFILES users do not have VIEW_PROFILES authority, so they are being denied access. Likewise, your intention to restrict access to ../edit/ to users with EDIT_PROFILES authority is being undermined by the earlier statement which grants access to users with VIEW_PROFILES authority.

Switch the order for the easy fix, and you probably want to give your EDIT_PROFILES users VIEW_PROFILES authority (in addition to EDIT_PROFILES authority). Then, consider using access="hasAnyRole('REQUIRED_ROLE')" rather than access="hasRole('REQUIRED_ROLE')", to simplify the access statements.

Upvotes: 2

John Farrelly
John Farrelly

Reputation: 7459

Make sure that your EDIT_PROFILES rule is above the VIEW_PROFILES rule. If you take a look at the expression for VIEW_PROFILES, you will see that it includes every URL that would match EDIT_PROFILES. That means that if the VIEW_PROFILES rule is first, spring security will never bother to try the EDIT_PROFILES rule.

Upvotes: 1

Related Questions