Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Prevent using both authorizeRequests and authorizeHttpRequests

Browse Source 
Closes gh-10573
This commit is contained in:
Marcus Da Coregio
2021-12-02 15:58:09 -03:00
committed by Marcus Hert Da Coregio
parent 62e8799a8d
commit ed3b0fbaad
2 changed files with 65 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java
View File

@@ -2889,8 +2889,15 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
}
}
@SuppressWarnings("unchecked")
@Override
protected DefaultSecurityFilterChain performBuild() {
ExpressionUrlAuthorizationConfigurer<?> expressionConfigurer = getConfigurer(
ExpressionUrlAuthorizationConfigurer.class);
AuthorizeHttpRequestsConfigurer<?> httpConfigurer = getConfigurer(AuthorizeHttpRequestsConfigurer.class);
boolean oneConfigurerPresent = expressionConfigurer == null ^ httpConfigurer == null;
Assert.state((expressionConfigurer == null && httpConfigurer == null) || oneConfigurerPresent,
"authorizeHttpRequests cannot be used in conjunction with authorizeRequests. Please select just one.");
this.filters.sort(OrderComparator.INSTANCE);
List<Filter> sortedFilters = new ArrayList<>(this.filters.size());
for (Filter filter : this.filters) {