liveBook · Manning

Endpoint authorization

As explained in Spring Security in Action, Second Edition

Endpoint authorization is authorization enforcement applied by matching incoming requests at web application endpoints.

Endpoint authorization enforces access rules by matching incoming requests at web application endpoints. In a reactive Spring application, configure these rules with a SecurityWebFilterChain bean rather than SecurityFilterChain. section 17.3.1

Independent endpoint policies

A reactive controller can expose /hello, which returns a greeting containing the authenticated user name, and /ciao, which returns "Ciao!" without requiring authentication. Calling /hello with john's credentials returns "Hello john".

Listing 17.7 Configuring endpoint authorization for reactive apps
@Configuration
public class ProjectConfig {

  // Omitted code

  @Bean
  public SecurityWebFilterChain securityWebFilterChain(
    ServerHttpSecurity http) {
    
    http.httpBasic(Customizer.withDefaults());

    http.authorizeExchange(                             #1
      c -> c.pathMatchers(HttpMethod.GET, "/hello")     #2
                .authenticated()                        #3
            .anyExchange()                              #4
                .permitAll()                            #5
    );      
               
               
    return http.build();                                #6
  }
}

Use the complete reactive SecurityWebFilterChain configuration to connect HTTP Basic authentication, path matching, authorization decisions, and application startup. section 17.3.1

How Spring Security in Action, Second Edition covers it

How deep it goes
Provides runnable path-match configuration and custom access hooks, while deferring detailed user-management declarations.
Examples
Uses /hello and /ciao endpoints, a john user, HTTP Basic credentials, path matchers, and a curl request.
What it assumes
Assumes a reactive web application and separately defines reactive user details and password encoding for authenticated endpoints.
What you can do after
Configure reactive endpoint access and test authenticated and unauthenticated requests with HTTP Basic credentials.
How it connects
Connects endpoint authorization with reactive applications, authentication, HTTP Basic, SecurityWebFilterChain, and authorization managers.
Cover of Spring Security in Action, Second Edition
liveBookmanning.com
Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.