liveBook · Manning

AuthorizationContext

As explained in Spring Security in Action, Second Edition

AuthorizationContext is a reactive Spring Security object that provides information about the server exchange being authorized.

AuthorizationContext is the reactive Spring Security object that exposes request details to custom endpoint authorization. An access() function receives it alongside Authentication, allowing decisions based on the request path, headers, query parameters, cookies, and related exchange data. section 17.3.1

Restricting an endpoint by request context

A custom access function can read the request path from AuthorizationContext, require ROLE_ADMIN for /hello, and combine that check with a time condition. It returns AuthorizationDecision(true) to allow the request or AuthorizationDecision(false) to reject it; failed rules produce 403 Forbidden. section 17.3.1

How Spring Security in Action, Second Edition covers it

How deep it goes
Explains available request data and path extraction, but defers the framework's lower-level authorization implementation.
Examples
Demonstrates path checks, headers, query parameters, cookies, administrator roles, and a before-noon condition.
What it assumes
Assumes basic reactive Spring Security configuration and Authentication, while showing how to obtain request data from the exchange.
What you can do after
Apply it via Spring Security's access() method to implement custom reactive authorization decisions.
How it connects
Connects Authentication, AuthorizationDecision, SecurityWebFilterChain, AuthorizationWebFilter, and ReactiveAuthorizationManager.
Cover of Spring Security in Action, Second Edition
liveBookmanning.com
Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.