Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Rework security request matchers

Browse Source 
Update the security request matchers so that a bean is no longer needed
when the matcher is used. Matchers can now be build by starting from
the `EndpointRequest` or `StaticResourceRequest` classes. For example:

http.authorizeRequests()
  .requestMatchers(EndpointRequest.to("status", "info")).permitAll()
  .requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ACTUATOR")
  .requestMatchers(StaticResourceRequest.toCommonLocations()).permitAll()

Closes gh-7958
This commit is contained in:
Phillip Webb
2017-08-31 16:10:12 -07:00
parent 2e51b48cd9
commit 46dfe38b60
20 changed files with 1294 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
spring-boot-samples/spring-boot-sample-actuator-custom-security/src/main/java/sample/actuator/customsecurity/SecurityConfiguration.java
View File

@@ -1,5 +1,7 @@
package sample.actuator.customsecurity;
import org.springframework.boot.actuate.autoconfigure.security.EndpointRequest;
import org.springframework.boot.autoconfigure.security.StaticResourceRequest;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -17,18 +19,17 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
// FIXME
// @formatter:off
// http.authorizeRequests()
// .requestMatchers(endpointIds("status", "info")).permitAll()
// .requestMatchers(endpointIds(SpringBootSecurity.ALL_ENDPOINTS)).hasRole("ACTUATOR")
// .requestMatchers(staticResources()).permitAll()
// .antMatchers("/foo").permitAll()
// .antMatchers("/**").hasRole("USER")
// .and()
// .cors()
// .and()
// .httpBasic();
http.authorizeRequests()
.requestMatchers(EndpointRequest.to("status", "info")).permitAll()
.requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ACTUATOR")
.requestMatchers(StaticResourceRequest.toCommonLocations()).permitAll()
.antMatchers("/foo").permitAll()
.antMatchers("/**").hasRole("USER")
.and()
.cors()
.and()
.httpBasic();
// @formatter:on
}

10
spring-boot-samples/spring-boot-sample-secure-oauth2-actuator/src/main/java/sample/secure/oauth2/actuator/ActuatorSecurityConfiguration.java
View File

@@ -1,5 +1,6 @@
package sample.secure.oauth2.actuator;
import org.springframework.boot.actuate.autoconfigure.security.EndpointRequest;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -16,12 +17,11 @@ public class ActuatorSecurityConfiguration extends WebSecurityConfigurerAdapter
@Override
protected void configure(HttpSecurity http) throws Exception {
// FIXME
// @formatter:off
// http.requestMatcher(ALL_ENDPOINTS).authorizeRequests()
// .antMatchers("/**").authenticated()
// .and()
// .httpBasic();
http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests()
.antMatchers("/**").authenticated()
.and()
.httpBasic();
// @formatter:on
}

10
spring-boot-samples/spring-boot-sample-web-method-security/src/main/java/sample/security/method/SampleMethodSecurityApplication.java
View File

@@ -19,6 +19,7 @@ package sample.security.method;
import java.util.Date;
import java.util.Map;
import org.springframework.boot.actuate.autoconfigure.security.EndpointRequest;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.builder.SpringApplicationBuilder;
import org.springframework.context.annotation.Configuration;
@@ -104,9 +105,12 @@ public class SampleMethodSecurityApplication implements WebMvcConfigurer {
@Override
protected void configure(HttpSecurity http) throws Exception {
// FIXME
// http.requestMatcher(ALL_ENDPOINTS)
// .authorizeRequests().anyRequest().authenticated().and().httpBasic();
// @formatter:off
http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests()
.anyRequest().authenticated()
.and()
.httpBasic();
// @formatter:on
}
}

16
spring-boot-samples/spring-boot-sample-web-secure/src/main/java/sample/web/secure/SampleWebSecureApplication.java
View File

@@ -20,6 +20,7 @@ import java.util.Date;
import java.util.Map;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.autoconfigure.security.StaticResourceRequest;
import org.springframework.boot.builder.SpringApplicationBuilder;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
@@ -62,15 +63,14 @@ public class SampleWebSecureApplication implements WebMvcConfigurer {
@Override
protected void configure(HttpSecurity http) throws Exception {
// FIXME
// @formatter:off
// http.authorizeRequests()
// .requestMatchers(staticResources()).permitAll()
// .anyRequest().fullyAuthenticated()
// .and()
// .formLogin().loginPage("/login").failureUrl("/login?error").permitAll()
// .and()
// .logout().permitAll();
http.authorizeRequests()
.requestMatchers(StaticResourceRequest.toCommonLocations()).permitAll()
.anyRequest().fullyAuthenticated()
.and()
.formLogin().loginPage("/login").failureUrl("/login?error").permitAll()
.and()
.logout().permitAll();
// @formatter:on
}