CODEWITHSUNDEEP
javaspringspring-bootrestspring-security
wolf
wolf

Reputation: 188

Spring Security: what do authorizeRequests(), anyRequest() and authenticated() do?

In the below code what do the different chained methods do?

protected void configure(HttpSecurity http ) throws Exception {

    http.authorizeRequests()
        .antMatchers(PUBLIC_URL).permitAll()
        .anyRequest().authenticated();
    
}

NOTE: PUBLIC_URL is an array of strings containing public URLs.

Upvotes: 8

Views: 12135

Answers (2)

Romil Patel
Romil Patel

Reputation: 13747

  • authorizeRequests() Allows restricting access based upon the HttpServletRequest using RequestMatcher implementations.

  • permitAll() This will allow the public access that is anyone can access endpoint PUBLIC_URL without authentication.

  • anyRequest().authenticated() will restrict the access for any other endpoint other than PUBLIC_URL, and the user must be authenticated.

We can also configure access based on authorities, can manage the sessions, HTTPS channel and much more. You may find more details from configure(HttpSecurity http).

Upvotes: 12

Manta
Manta

Reputation: 517

It means that all requests must be authenticated except those matching PUBLIC_URL

Upvotes: 1

Related Questions