CODEWITHSUNDEEP
spring-security
Santa Monica
Santa Monica

Reputation: 441

Spring Security what is the difference between Authorization Manager and AccessDecisionManager?

Spring Security what is the difference between Authorization Manager and AccessDecisionManager, and how do they interact with each other?

Upvotes: 0

Views: 1383

Answers (1)

Marcus Hert da Coregio
Marcus Hert da Coregio

Reputation: 6308

The AuthorizationManager, from Spring Security documentation:

AuthorizationManager supersedes both AccessDecisionManager and AccessDecisionVoter. Applications that customize an AccessDecisionManager or AccessDecisionVoter are encouraged to change to using AuthorizationManager. AuthorizationManagers are called by the AuthorizationFilter and are responsible for making final access control decisions.

The deprecated AccessDecisionManager, from Spring Security documentation:

The AccessDecisionManager is called by the AbstractSecurityInterceptor and is responsible for making final access control decisions.

In summary, the AuthorizationManager is a new API that supersedes the AccessDecisionManager. If you are using authorizeHttpRequests instead of authorizeRequest, you are already using the AuthorizationManager API.

Upvotes: 3

Related Questions