Authorization determines which requests an authenticated user may access. In Spring Security, you can match URL paths to requirements such as a granted role or permission for everyone. section 5.3.1
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
return http
.authorizeRequests()
.antMatchers("/design", "/orders").hasRole("USER")
.antMatchers("/", "/**").permitAll()
.and()
.build();
}
This configuration protects /design and /orders with the USER role and permits other requests. section 5.3.1
When writing URL rules, keep these behaviors in mind:
- Rules are checked in declaration order, so put specific protected paths before a broad permit-all rule. section 5.3.1
- hasRole("USER") checks for ROLE_USER; Spring supplies the ROLE_ prefix. section 5.3.1 section 5.2.2
A conditional access rule
Spring Expression Language (SpEL) lets a rule combine conditions. For example, a rule can require ROLE_USER and allow taco creation only on Tuesdays. section 5.3.1
