Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Rework security request matchers

Browse Source 
Update the security request matchers so that a bean is no longer needed
when the matcher is used. Matchers can now be build by starting from
the `EndpointRequest` or `StaticResourceRequest` classes. For example:

http.authorizeRequests()
  .requestMatchers(EndpointRequest.to("status", "info")).permitAll()
  .requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ACTUATOR")
  .requestMatchers(StaticResourceRequest.toCommonLocations()).permitAll()

Closes gh-7958
This commit is contained in:
Phillip Webb
2017-08-31 16:10:12 -07:00
parent 2e51b48cd9
commit 46dfe38b60
20 changed files with 1294 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
spring-boot-samples/spring-boot-sample-actuator-custom-security/src/main/java/sample/actuator/customsecurity/SecurityConfiguration.java
View File

@@ -1,5 +1,7 @@
package sample.actuator.customsecurity;
import org.springframework.boot.actuate.autoconfigure.security.EndpointRequest;
import org.springframework.boot.autoconfigure.security.StaticResourceRequest;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@@ -17,18 +19,17 @@ public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
// FIXME
// @formatter:off
// http.authorizeRequests()
// .requestMatchers(endpointIds("status", "info")).permitAll()
// .requestMatchers(endpointIds(SpringBootSecurity.ALL_ENDPOINTS)).hasRole("ACTUATOR")
// .requestMatchers(staticResources()).permitAll()
// .antMatchers("/foo").permitAll()
// .antMatchers("/**").hasRole("USER")
// .and()
// .cors()
// .and()
// .httpBasic();
http.authorizeRequests()
.requestMatchers(EndpointRequest.to("status", "info")).permitAll()
.requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("ACTUATOR")
.requestMatchers(StaticResourceRequest.toCommonLocations()).permitAll()
.antMatchers("/foo").permitAll()
.antMatchers("/**").hasRole("USER")
.and()
.cors()
.and()
.httpBasic();
// @formatter:on
}