Use securityMatcher() and authorizeHttpRequests()

Closes gh-922

docs/src/docs/asciidoc/examples/src/main/java/sample/userinfo/jwt/JwtUserInfoMapperSecurityConfig.java

@@ -83,8 +83,8 @@ public class JwtUserInfoMapperSecurityConfig {
 				)
 			);
 		http
-			.requestMatcher(endpointsMatcher)
+			.securityMatcher(endpointsMatcher)
-			.authorizeRequests((authorize) -> authorize
+			.authorizeHttpRequests((authorize) -> authorize
 				.anyRequest().authenticated()
 			)
 			.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))

oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configuration/OAuth2AuthorizationServerConfiguration.java

@@ -63,9 +63,9 @@ public class OAuth2AuthorizationServerConfiguration {
 				.getEndpointsMatcher();
 
 		http
-			.requestMatcher(endpointsMatcher)
+			.securityMatcher(endpointsMatcher)
-			.authorizeRequests(authorizeRequests ->
+			.authorizeHttpRequests(authorize ->
-				authorizeRequests.anyRequest().authenticated()
+				authorize.anyRequest().authenticated()
 			)
 			.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
 			.apply(authorizationServerConfigurer);

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2AuthorizationCodeGrantTests.java

@@ -843,9 +843,9 @@ public class OAuth2AuthorizationCodeGrantTests {
 			RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();
 
 			http
-					.requestMatcher(endpointsMatcher)
+					.securityMatcher(endpointsMatcher)
-					.authorizeRequests(authorizeRequests ->
+					.authorizeHttpRequests(authorize ->
-							authorizeRequests.anyRequest().authenticated()
+							authorize.anyRequest().authenticated()
 					)
 					.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
 					.securityContext(securityContext ->
@@ -905,9 +905,9 @@ public class OAuth2AuthorizationCodeGrantTests {
 			RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();
 
 			http
-					.requestMatcher(endpointsMatcher)
+					.securityMatcher(endpointsMatcher)
-					.authorizeRequests(authorizeRequests ->
+					.authorizeHttpRequests(authorize ->
-							authorizeRequests.anyRequest().authenticated()
+							authorize.anyRequest().authenticated()
 					)
 					.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
 					.apply(authorizationServerConfigurer);
@@ -938,9 +938,9 @@ public class OAuth2AuthorizationCodeGrantTests {
 			RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();
 
 			http
-					.requestMatcher(endpointsMatcher)
+					.securityMatcher(endpointsMatcher)
-					.authorizeRequests(authorizeRequests ->
+					.authorizeHttpRequests(authorize ->
-							authorizeRequests.anyRequest().authenticated()
+							authorize.anyRequest().authenticated()
 					)
 					.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
 					.apply(authorizationServerConfigurer);
@@ -1029,9 +1029,9 @@ public class OAuth2AuthorizationCodeGrantTests {
 			RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();
 
 			http
-					.requestMatcher(endpointsMatcher)
+					.securityMatcher(endpointsMatcher)
-					.authorizeRequests(authorizeRequests ->
+					.authorizeHttpRequests(authorize ->
-							authorizeRequests.anyRequest().authenticated()
+							authorize.anyRequest().authenticated()
 					)
 					.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
 					.apply(authorizationServerConfigurer);

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2AuthorizationServerMetadataTests.java

@@ -178,9 +178,9 @@ public class OAuth2AuthorizationServerMetadataTests {
 			RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();
 
 			http
-					.requestMatcher(endpointsMatcher)
+					.securityMatcher(endpointsMatcher)
-					.authorizeRequests(authorizeRequests ->
+					.authorizeHttpRequests(authorize ->
-							authorizeRequests.anyRequest().authenticated()
+							authorize.anyRequest().authenticated()
 					)
 					.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher));
 

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2ClientCredentialsGrantTests.java

@@ -415,9 +415,9 @@ public class OAuth2ClientCredentialsGrantTests {
 			RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();
 
 			http
-					.requestMatcher(endpointsMatcher)
+					.securityMatcher(endpointsMatcher)
-					.authorizeRequests(authorizeRequests ->
+					.authorizeHttpRequests(authorize ->
-							authorizeRequests.anyRequest().authenticated()
+							authorize.anyRequest().authenticated()
 					)
 					.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
 					.apply(authorizationServerConfigurer);
@@ -447,9 +447,9 @@ public class OAuth2ClientCredentialsGrantTests {
 			RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();
 
 			http
-					.requestMatcher(endpointsMatcher)
+					.securityMatcher(endpointsMatcher)
-					.authorizeRequests(authorizeRequests ->
+					.authorizeHttpRequests(authorize ->
-							authorizeRequests.anyRequest().authenticated()
+							authorize.anyRequest().authenticated()
 					)
 					.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
 					.apply(authorizationServerConfigurer);

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2TokenIntrospectionTests.java

@@ -519,9 +519,9 @@ public class OAuth2TokenIntrospectionTests {
 			RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();
 
 			http
-					.requestMatcher(endpointsMatcher)
+					.securityMatcher(endpointsMatcher)
-					.authorizeRequests(authorizeRequests ->
+					.authorizeHttpRequests(authorize ->
-							authorizeRequests.anyRequest().authenticated()
+							authorize.anyRequest().authenticated()
 					)
 					.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
 					.apply(authorizationServerConfigurer);

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2TokenRevocationTests.java

@@ -339,9 +339,9 @@ public class OAuth2TokenRevocationTests {
 			RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();
 
 			http
-					.requestMatcher(endpointsMatcher)
+					.securityMatcher(endpointsMatcher)
-					.authorizeRequests(authorizeRequests ->
+					.authorizeHttpRequests(authorize ->
-							authorizeRequests.anyRequest().authenticated()
+							authorize.anyRequest().authenticated()
 					)
 					.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
 					.apply(authorizationServerConfigurer);

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OidcClientRegistrationTests.java

@@ -366,9 +366,9 @@ public class OidcClientRegistrationTests {
 			RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();
 
 			http
-					.requestMatcher(endpointsMatcher)
+					.securityMatcher(endpointsMatcher)
-					.authorizeRequests(authorizeRequests ->
+					.authorizeHttpRequests(authorize ->
-							authorizeRequests.anyRequest().authenticated()
+							authorize.anyRequest().authenticated()
 					)
 					.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
 					.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt)

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OidcProviderConfigurationTests.java

@@ -235,9 +235,9 @@ public class OidcProviderConfigurationTests {
 			RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();
 
 			http
-					.requestMatcher(endpointsMatcher)
+					.securityMatcher(endpointsMatcher)
-					.authorizeRequests(authorizeRequests ->
+					.authorizeHttpRequests(authorize ->
-							authorizeRequests.anyRequest().authenticated()
+							authorize.anyRequest().authenticated()
 					)
 					.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher));
 

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OidcTests.java

@@ -367,9 +367,9 @@ public class OidcTests {
 			RequestMatcher endpointsMatcher = authorizationServerConfigurer.getEndpointsMatcher();
 
 			http
-					.requestMatcher(endpointsMatcher)
+					.securityMatcher(endpointsMatcher)
-					.authorizeRequests(authorizeRequests ->
+					.authorizeHttpRequests(authorize ->
-							authorizeRequests.anyRequest().authenticated()
+							authorize.anyRequest().authenticated()
 					)
 					.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher));
 

oauth2-authorization-server/src/test/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OidcUserInfoTests.java

@@ -280,9 +280,9 @@ public class OidcUserInfoTests {
 
 			// @formatter:off
 			http
-				.requestMatcher(endpointsMatcher)
+				.securityMatcher(endpointsMatcher)
-				.authorizeRequests(authorizeRequests ->
+				.authorizeHttpRequests(authorize ->
-					authorizeRequests.anyRequest().authenticated()
+					authorize.anyRequest().authenticated()
 				)
 				.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
 				.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt)
@@ -311,9 +311,9 @@ public class OidcUserInfoTests {
 
 			// @formatter:off
 			http
-				.requestMatcher(endpointsMatcher)
+				.securityMatcher(endpointsMatcher)
-				.authorizeRequests(authorizeRequests ->
+				.authorizeHttpRequests(authorize ->
-					authorizeRequests.anyRequest().authenticated()
+					authorize.anyRequest().authenticated()
 				)
 				.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
 				.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt)
@@ -338,9 +338,9 @@ public class OidcUserInfoTests {
 
 			// @formatter:off
 			http
-				.requestMatcher(endpointsMatcher)
+				.securityMatcher(endpointsMatcher)
-				.authorizeRequests(authorizeRequests ->
+				.authorizeHttpRequests(authorize ->
-					authorizeRequests.anyRequest().authenticated()
+					authorize.anyRequest().authenticated()
 				)
 				.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
 				.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt)

samples/custom-consent-authorizationserver/src/main/java/sample/config/AuthorizationServerConfig.java

@@ -67,9 +67,9 @@ public class AuthorizationServerConfig {
 				.getEndpointsMatcher();
 
 		http
-			.requestMatcher(endpointsMatcher)
+			.securityMatcher(endpointsMatcher)
-			.authorizeRequests(authorizeRequests ->
+			.authorizeHttpRequests(authorize ->
-				authorizeRequests.anyRequest().authenticated()
+				authorize.anyRequest().authenticated()
 			)
 			.csrf(csrf -> csrf.ignoringRequestMatchers(endpointsMatcher))
 			.exceptionHandling(exceptions ->

samples/custom-consent-authorizationserver/src/main/java/sample/config/DefaultSecurityConfig.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 the original author or authors.
+ * Copyright 2020-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -36,8 +36,8 @@ public class DefaultSecurityConfig {
 	@Bean
 	SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
 		http
-			.authorizeRequests(authorizeRequests ->
+			.authorizeHttpRequests(authorize ->
-				authorizeRequests.anyRequest().authenticated()
+				authorize.anyRequest().authenticated()
 			)
 			.formLogin(withDefaults());
 		return http.build();

samples/default-authorizationserver/src/main/java/sample/config/DefaultSecurityConfig.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 the original author or authors.
+ * Copyright 2020-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -37,8 +37,8 @@ public class DefaultSecurityConfig {
 	@Bean
 	SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
 		http
-			.authorizeRequests(authorizeRequests ->
+			.authorizeHttpRequests(authorize ->
-				authorizeRequests.anyRequest().authenticated()
+				authorize.anyRequest().authenticated()
 			)
 			.formLogin(withDefaults());
 		return http.build();

samples/federated-identity-authorizationserver/src/main/java/sample/config/DefaultSecurityConfig.java

@@ -41,9 +41,9 @@ public class DefaultSecurityConfig {
 		FederatedIdentityConfigurer federatedIdentityConfigurer = new FederatedIdentityConfigurer()
 			.oauth2UserHandler(new UserRepositoryOAuth2UserHandler());
 		http
-			.authorizeRequests(authorizeRequests ->
+			.authorizeHttpRequests(authorize ->
-				authorizeRequests
+				authorize
-					.mvcMatchers("/assets/**", "/webjars/**", "/login").permitAll()
+					.requestMatchers("/assets/**", "/webjars/**", "/login").permitAll()
 					.anyRequest().authenticated()
 			)
 			.formLogin(Customizer.withDefaults())

samples/messages-client/src/main/java/sample/config/SecurityConfig.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 the original author or authors.
+ * Copyright 2020-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -32,15 +32,15 @@ public class SecurityConfig {
 
 	@Bean
 	WebSecurityCustomizer webSecurityCustomizer() {
-		return (web) -> web.ignoring().antMatchers("/webjars/**");
+		return (web) -> web.ignoring().requestMatchers("/webjars/**");
 	}
 
 	// @formatter:off
 	@Bean
 	SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
 		http
-			.authorizeRequests(authorizeRequests ->
+			.authorizeHttpRequests(authorize ->
-				authorizeRequests.anyRequest().authenticated()
+				authorize.anyRequest().authenticated()
 			)
 			.oauth2Login(oauth2Login ->
 				oauth2Login.loginPage("/oauth2/authorization/messaging-client-oidc"))

samples/messages-resource/src/main/java/sample/config/ResourceServerConfig.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2021 the original author or authors.
+ * Copyright 2020-2022 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,9 +31,9 @@ public class ResourceServerConfig {
 	@Bean
 	SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
 		http
-			.mvcMatcher("/messages/**")
+			.securityMatcher("/messages/**")
-				.authorizeRequests()
+				.authorizeHttpRequests()
-					.mvcMatchers("/messages/**").access("hasAuthority('SCOPE_message.read')")
+					.requestMatchers("/messages/**").hasAuthority("SCOPE_message.read")
 					.and()
 			.oauth2ResourceServer()
 				.jwt();