liveBook · Manning

AuthorizationDecision

As explained in Spring Security in Action, Second Edition

AuthorizationDecision is a Spring Security result object that indicates whether an authorization request is permitted.

AuthorizationDecision is the result returned by a reactive authorization rule. Construct it with true to allow a request or false to deny it. section 17.3.1

An access function receives the authenticated user and request context, then returns a Mono<AuthorizationDecision>. Authentication supplies authorities; AuthorizationContext supplies paths and other request data. section 17.3.1

Time- and role-sensitive endpoint authorization

A custom rule can inspect the request path, current time, and authorities before returning a decision. A failed rule produces HTTP 403 Forbidden. section 17.3.1

How Spring Security in Action, Second Edition covers it

How deep it goes
Defines boolean construction and reactive return flow, but does not detail internal decision-manager implementation.
Examples
Uses endpoint paths, a noon cutoff, ROLE_ADMIN authorities, curl authentication, and a 403 Forbidden response.
What it assumes
Assumes basic reactive Spring Security configuration, authentication, authorities, and request context access.
What you can do after
Build custom reactive authorization callbacks that allow or deny requests from authentication and request details.
How it connects
Connects Authentication, AuthorizationContext, ReactiveAuthorizationManager, AuthorizationWebFilter, and SecurityWebFilterChain.
Cover of Spring Security in Action, Second Edition
liveBookmanning.com
Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.