liveBook · Manning

pathMatchers()

As explained in Spring Security in Action, Second Edition

pathMatchers() is a reactive authorization configuration method that matches server exchanges according to request paths and related attributes.

pathMatchers() groups reactive HTTP exchanges by request path so each group can receive an authorization rule. section 17.3.1

Use it inside authorizeExchange() on ServerHttpSecurity, then attach rules such as authenticated(), permitAll(), denyAll(), hasRole(), or hasAuthority(). section 17.3.1

Protecting one reactive endpoint

A security chain can require authentication for GET requests to /hello while permitting every other exchange: c.pathMatchers(HttpMethod.GET, "/hello").authenticated().anyExchange().permitAll().

How Spring Security in Action, Second Edition covers it

How deep it goes
Defines matcher placement and common authorization outcomes, but defers custom access decisions to a separate mechanism.
Examples
Uses GET /hello as a protected endpoint and permits other exchanges through anyExchange().
What it assumes
Assumes familiarity with endpoint authorization, then maps requestMatchers() concepts to authorizeExchange() and pathMatchers().
What you can do after
Apply it via ServerHttpSecurity to protect selected WebFlux paths and define fallback access.
How it connects
Connects authorizeExchange(), requestMatchers(), authenticated(), anyExchange(), and reactive endpoint authorization.
Cover of Spring Security in Action, Second Edition
liveBookmanning.com
Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.