liveBook · Manning

authorizeExchange()

As explained in Spring Security in Action, Second Edition

authorizeExchange() is a ServerHttpSecurity configuration method for defining authorization rules for reactive server exchanges.

authorizeExchange() configures endpoint authorization for reactive applications. It is called on ServerHttpSecurity while building a SecurityWebFilterChain bean, then combines request matchers with authorization decisions. section 17.3.1 section 17.5

Protecting one reactive endpoint

The following configuration requires authentication for GET requests to /hello while allowing all other exchanges. http.authorizeExchange(c -> c.pathMatchers(HttpMethod.GET, "/hello").authenticated().anyExchange().permitAll());

Chain an exchange matcher with an authorization rule:

  • pathMatchers() groups exchanges by request path and can be paired with authenticated() or other decisions. section 17.3.1
  • permitAll() allows requests without authentication, while denyAll() rejects every matching exchange. section 17.3.1
  • hasRole(), hasAnyRole(), hasAuthority(), and hasAnyAuthority() apply role- or authority-based rules. section 17.3.1
  • anyExchange() supplies a catch-all exchange matcher, and access() supports a custom reactive authorization decision. section 17.3.1

How Spring Security in Action, Second Edition covers it

How deep it goes
Explains matcher chaining, standard decisions, and custom access() callbacks, while deferring detailed authorization internals.
Examples
Demonstrates authenticated GET access to /hello, public fallback exchanges, HTTP Basic authentication, and custom time- or role-sensitive decisions.
What it assumes
Assumes basic Spring and Java configuration, while establishing the reactive counterparts of non-reactive authorization methods.
What you can do after
Builds a SecurityWebFilterChain that protects reactive endpoints with authentication, roles, authorities, public access, denial, or custom decisions.
How it connects
Connects reactive endpoint authorization with ServerHttpSecurity, SecurityWebFilterChain, pathMatchers(), anyExchange(), and reactive method security.
Cover of Spring Security in Action, Second Edition
liveBookmanning.com
Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.