How to neatly configure Spring WebSecurity
I'm currently working on setting up a reverse proxy security domain using Spring Security, and the idea is to require the bearer token on all the requests by default, except for a few exceptions such as signing up etc. Current my configuration function looks as follows:
@Override
protected void configure(HttpSecurity http) throws Exception {
http.cors().and().csrf().disable().authorizeRequests()
.antMatchers(HttpMethod.POST, SIGN_UP_URL).permitAll()
.anyRequest().authenticated()
.and()
.addFilter(new JWTAuthenticationFilter(authenticationManager()))
.addFilter(new JWTAuthorizationFilter(authenticationManager()))
// this disables session creation on Spring Security
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
Ant matchers are pretty useful, but you have to pass all the URLs in individually. Is there a way for me to pass in an array of Strings instead so that I can keep the configuration separate?
spring spring-boot spring-security
asked 20 hours ago
NodziGamesNodziGames
63110
add a comment |
I'm currently working on setting up a reverse proxy security domain using Spring Security, and the idea is to require the bearer token on all the requests by default, except for a few exceptions such as signing up etc. Current my configuration function looks as follows:
@Override
protected void configure(HttpSecurity http) throws Exception {
http.cors().and().csrf().disable().authorizeRequests()
.antMatchers(HttpMethod.POST, SIGN_UP_URL).permitAll()
.anyRequest().authenticated()
.and()
.addFilter(new JWTAuthenticationFilter(authenticationManager()))
.addFilter(new JWTAuthorizationFilter(authenticationManager()))
// this disables session creation on Spring Security
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
Ant matchers are pretty useful, but you have to pass all the URLs in individually. Is there a way for me to pass in an array of Strings instead so that I can keep the configuration separate?
spring spring-boot spring-security
asked 20 hours ago
NodziGamesNodziGames
63110
add a comment |
I'm currently working on setting up a reverse proxy security domain using Spring Security, and the idea is to require the bearer token on all the requests by default, except for a few exceptions such as signing up etc. Current my configuration function looks as follows:
@Override
protected void configure(HttpSecurity http) throws Exception {
http.cors().and().csrf().disable().authorizeRequests()
.antMatchers(HttpMethod.POST, SIGN_UP_URL).permitAll()
.anyRequest().authenticated()
.and()
.addFilter(new JWTAuthenticationFilter(authenticationManager()))
.addFilter(new JWTAuthorizationFilter(authenticationManager()))
// this disables session creation on Spring Security
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
Ant matchers are pretty useful, but you have to pass all the URLs in individually. Is there a way for me to pass in an array of Strings instead so that I can keep the configuration separate?
spring spring-boot spring-security
asked 20 hours ago
NodziGamesNodziGames
63110
I'm currently working on setting up a reverse proxy security domain using Spring Security, and the idea is to require the bearer token on all the requests by default, except for a few exceptions such as signing up etc. Current my configuration function looks as follows:
@Override
protected void configure(HttpSecurity http) throws Exception {
http.cors().and().csrf().disable().authorizeRequests()
.antMatchers(HttpMethod.POST, SIGN_UP_URL).permitAll()
.anyRequest().authenticated()
.and()
.addFilter(new JWTAuthenticationFilter(authenticationManager()))
.addFilter(new JWTAuthorizationFilter(authenticationManager()))
// this disables session creation on Spring Security
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
Ant matchers are pretty useful, but you have to pass all the URLs in individually. Is there a way for me to pass in an array of Strings instead so that I can keep the configuration separate?
spring spring-boot spring-security
spring spring-boot spring-security
asked 20 hours ago
NodziGamesNodziGames
63110
asked 20 hours ago
NodziGamesNodziGames
63110
asked 20 hours ago
NodziGamesNodziGames
63110
asked 20 hours ago
NodziGamesNodziGames
63110
asked 20 hours ago
NodziGamesNodziGames
63110
63110
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
http.cors().and().csrf().disable().authorizeRequests()
.antMatchers(HttpMethod.POST, SIGN_UP_URL).permitAll()
In the above code antMatchers will accept string array also. Below is the implementation of anyMatcher method in spring security 4.2.3.RELEASE. According to the method signature you should be able to pass a string array containing required paths.
/**
* Maps a {@link List} of
* {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher}
* instances that do not care which {@link HttpMethod} is used.
*
* @param antPatterns the ant patterns to create
* {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher} from
*
* @return the object that is chained after creating the {@link RequestMatcher}
*/
public C antMatchers(String... antPatterns) {
return chainRequestMatchers(RequestMatchers.antMatchers(antPatterns));
}
If you dig into implementation, spring is converting this args into a ArrayList of all paths.
Also, there is an alternate way. To Ignore the path which shall not be secured by spring security if you are extending spring's WebSecurityConfigurerAdapterclass, override same method again.
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("path":);
}
I guess it is neat this way.
answered 18 hours ago
ntulsintulsi
217
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54250173%2fhow-to-neatly-configure-spring-websecurity%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
http.cors().and().csrf().disable().authorizeRequests()
.antMatchers(HttpMethod.POST, SIGN_UP_URL).permitAll()
In the above code antMatchers will accept string array also. Below is the implementation of anyMatcher method in spring security 4.2.3.RELEASE. According to the method signature you should be able to pass a string array containing required paths.
/**
* Maps a {@link List} of
* {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher}
* instances that do not care which {@link HttpMethod} is used.
*
* @param antPatterns the ant patterns to create
* {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher} from
*
* @return the object that is chained after creating the {@link RequestMatcher}
*/
public C antMatchers(String... antPatterns) {
return chainRequestMatchers(RequestMatchers.antMatchers(antPatterns));
}
If you dig into implementation, spring is converting this args into a ArrayList of all paths.
Also, there is an alternate way. To Ignore the path which shall not be secured by spring security if you are extending spring's WebSecurityConfigurerAdapterclass, override same method again.
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("path":);
}
I guess it is neat this way.
answered 18 hours ago
ntulsintulsi
217
add a comment |
http.cors().and().csrf().disable().authorizeRequests()
.antMatchers(HttpMethod.POST, SIGN_UP_URL).permitAll()
In the above code antMatchers will accept string array also. Below is the implementation of anyMatcher method in spring security 4.2.3.RELEASE. According to the method signature you should be able to pass a string array containing required paths.
/**
* Maps a {@link List} of
* {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher}
* instances that do not care which {@link HttpMethod} is used.
*
* @param antPatterns the ant patterns to create
* {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher} from
*
* @return the object that is chained after creating the {@link RequestMatcher}
*/
public C antMatchers(String... antPatterns) {
return chainRequestMatchers(RequestMatchers.antMatchers(antPatterns));
}
If you dig into implementation, spring is converting this args into a ArrayList of all paths.
Also, there is an alternate way. To Ignore the path which shall not be secured by spring security if you are extending spring's WebSecurityConfigurerAdapterclass, override same method again.
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("path":);
}
I guess it is neat this way.
answered 18 hours ago
ntulsintulsi
217
add a comment |
http.cors().and().csrf().disable().authorizeRequests()
.antMatchers(HttpMethod.POST, SIGN_UP_URL).permitAll()
In the above code antMatchers will accept string array also. Below is the implementation of anyMatcher method in spring security 4.2.3.RELEASE. According to the method signature you should be able to pass a string array containing required paths.
/**
* Maps a {@link List} of
* {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher}
* instances that do not care which {@link HttpMethod} is used.
*
* @param antPatterns the ant patterns to create
* {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher} from
*
* @return the object that is chained after creating the {@link RequestMatcher}
*/
public C antMatchers(String... antPatterns) {
return chainRequestMatchers(RequestMatchers.antMatchers(antPatterns));
}
If you dig into implementation, spring is converting this args into a ArrayList of all paths.
Also, there is an alternate way. To Ignore the path which shall not be secured by spring security if you are extending spring's WebSecurityConfigurerAdapterclass, override same method again.
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("path":);
}
I guess it is neat this way.
answered 18 hours ago
ntulsintulsi
217
http.cors().and().csrf().disable().authorizeRequests()
.antMatchers(HttpMethod.POST, SIGN_UP_URL).permitAll()
In the above code antMatchers will accept string array also. Below is the implementation of anyMatcher method in spring security 4.2.3.RELEASE. According to the method signature you should be able to pass a string array containing required paths.
/**
* Maps a {@link List} of
* {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher}
* instances that do not care which {@link HttpMethod} is used.
*
* @param antPatterns the ant patterns to create
* {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher} from
*
* @return the object that is chained after creating the {@link RequestMatcher}
*/
public C antMatchers(String... antPatterns) {
return chainRequestMatchers(RequestMatchers.antMatchers(antPatterns));
}
If you dig into implementation, spring is converting this args into a ArrayList of all paths.
Also, there is an alternate way. To Ignore the path which shall not be secured by spring security if you are extending spring's WebSecurityConfigurerAdapterclass, override same method again.
@Override
public void configure(WebSecurity web) throws Exception {
web.ignoring().antMatchers("path":);
}
I guess it is neat this way.
answered 18 hours ago
ntulsintulsi
217
answered 18 hours ago
ntulsintulsi
217
answered 18 hours ago
ntulsintulsi
217
answered 18 hours ago
ntulsintulsi
217
217
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f54250173%2fhow-to-neatly-configure-spring-websecurity%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
