liveBook · Manning

Hasauthority

As explained in Spring Security in Action, Second Edition

hasAnyAuthority() is an authorization configuration method that permits a request when the user has at least one authority from a specified set.

hasAnyAuthority() restricts an endpoint to authenticated users possessing at least one authority from a specified set. It keeps authorization rules readable when several privileges grant access. section 7.1.1

Allow READ or WRITE

Configure the security filter chain with c -> c.anyRequest().hasAnyAuthority("WRITE", "READ"). Users holding either authority can call the endpoint; users holding neither receive 403 Forbidden.

Use the simplest rule matching the privilege model:

  • Prefer hasAnyAuthority() over access() when an endpoint needs an uncomplicated OR rule; reserve access() for custom or complex authorization expressions. section 7.1.1

How Spring Security in Action, Second Edition covers it

How deep it goes
Defines the method and demonstrates Java configuration and curl outcomes, but does not descend into its internal implementation.
Examples
Demonstrates READ and WRITE authorities on in-memory users calling a /hello endpoint with HTTP Basic credentials.
What it assumes
Assumes familiarity with basic Spring configuration and authority-bearing UserDetails, while demonstrating those assignments explicitly.
What you can do after
Apply it via Spring Security Java configuration to permit requests matching any listed authority.
How it connects
Connects authorities, UserDetails, GrantedAuthority, endpoint authorization, hasAuthority(), and access().
Cover of Spring Security in Action, Second Edition
liveBookmanning.com
Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.