Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-3135: antMatchers now allows method and no pattern

Browse Source 
Previously, antMatchers(POST).authenticated() was not allowed. Instead
users had to use antMatchers(POST, "/**").authenticated().

Now we default the patterns to be "/**" if it is null or empty.
This commit is contained in:
Rob Winch
2015-10-29 12:48:29 -05:00
parent 8f13beccb7
commit 6f1bb705ac
2 changed files with 90 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
config/src/main/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistry.java
View File

@@ -25,6 +25,7 @@ import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.AnyRequestMatcher;
import org.springframework.security.web.util.matcher.RegexRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher;
import org.springframework.util.ObjectUtils;
/**
* A base class for registering {@link RequestMatcher}'s. For example, it might allow for
@@ -151,6 +152,9 @@ public abstract class AbstractRequestMatcherRegistry<C> {
public static List<RequestMatcher> antMatchers(HttpMethod httpMethod,
String... antPatterns) {
String method = httpMethod == null ? null : httpMethod.toString();
if(ObjectUtils.isEmpty(antPatterns)) {
antPatterns = new String[] { "/**" };
}
List<RequestMatcher> matchers = new ArrayList<RequestMatcher>();
for (String pattern : antPatterns) {
matchers.add(new AntPathRequestMatcher(pattern, method));