CODEWITHSUNDEEP
springauthenticationspring-security
Yusufu
Yusufu

Reputation: 115

spring security architecture filter chain and request matcher

I have been reading spring security docs which is from here . There is an example: 

@Configuration
@Order(SecurityProperties.BASIC_AUTH_ORDER - 10)
public class ApplicationConfigurerAdapter extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
    http.antMatcher("/foo/**")
    .authorizeRequests()
        .antMatchers("/foo/bar").hasRole("BAR")
        .antMatchers("/foo/spam").hasRole("SPAM")
        .anyRequest().isAuthenticated();
    }
}

And it says

One of the easiest mistakes to make with configuring Spring Security is to forget that these matchers apply to different processes, one is a request matcher for the whole filter chain, and the other is only to choose the access rule to apply.

I want to learn what it is this forget ? I couldn't get the relation and filter chain and request matcher

Upvotes: 0

Views: 770

Answers (1)

Marco Behler
Marco Behler

Reputation: 3724

It is a very convoluted way to say:

  1. .anyRequest().isAuthenticated(); makes sure that to access any url in your application, a user needs to be authenticated.
  2. In addition, the two ant matchers are simply checking the needed roles (=access rules), in addition to the user being authenticated.

The paragraph is badly written, imho.

Upvotes: 2

Related Questions