A path expression selects endpoint requests by URL structure, allowing one authorization rule to cover related paths without enumerating every endpoint. section 8.2
Common path-pattern forms include:
- `/a` matches only `/a`; `/a/*` matches one pathname such as `/a/b`, but not `/a/b/c`. section 8.2
- `/a/**` matches multiple pathnames, including `/a`, `/a/b`, and `/a/b/c`; it can also appear mid-path, as in `/a/**/c`. section 8.2
- `/a/{param}` matches a path variable, while `/a/{param:regex}` restricts that variable to values matching a regular expression. section 8.2
- Prefer path expressions for readable rules; use a regex matcher when requirements cannot be expressed clearly with path syntax. section 8.3
Protecting a path family
Configure `requestMatchers("/a/b/**").authenticated().anyRequest().permitAll()`. `/a` remains accessible without authentication, while `/a/b` and `/a/b/c` require authentication. A path variable can be constrained similarly: `requestMatchers("/product/{code:^[0-9]*$}").permitAll()` permits numeric product codes and denies other requests. section 8.2
Table 8.1 Common expressions used for path matching with MVC matchers (view table figure)
| Expression |
Description |
|---|---|
| /a |
Only path /a. |
| /a/* |
The * operator replaces one pathname. In this case, it matches /a/b or /a/c, but not /a/b/c. |
| /a/** |
The ** operator replaces multiple pathnames. In this case, /a, /a/b, and /a/b/c are a match for this expression. |
| /a/{param} |
This expression applies to the path /a with a given path parameter. |
| /a/{param:regex} |
This expression applies to the path /a with a given path parameter only when the value of the parameter matches the given regular expression. |
Browse the compact reference table for exact, single-segment, multi-segment, variable, and regex-constrained path patterns. section 8.2
