An OAuth2 scope is a named permission that limits which protected resources or claims a client may request. A provider grants requested scopes after the user authorizes the application. section 5.3.3 section 8.3
In a Spring resource server, scopes connect tokens to endpoint permissions:
- Require writeIngredients for POST requests to /ingredients by matching the authority SCOPE_writeIngredients. section 8.3
- Require deleteIngredients for DELETE requests by matching SCOPE_deleteIngredients. section 8.3
- Request provider access such as email and public_profile through the client registration's scope property. section 5.3.3
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
...
.antMatchers(HttpMethod.POST, "/api/ingredients")
.hasAuthority("SCOPE_writeIngredients")
.antMatchers(HttpMethod.DELETE, "/api/ /ingredients")
.hasAuthority("SCOPE_deleteIngredients")
...
}
Inspect endpoint rules that map OAuth2 scopes to Spring Security authorities. section 8.3
Protecting an ingredients API
A request that creates an ingredient must carry an access token containing writeIngredients. The resource server inspects the JWT, verifies its signature using the authorization server's public key, and allows the request only when the required scope is present. section 8.3
