ServerHttpSecurity is the reactive configuration builder used to define endpoint authorization and build a SecurityWebFilterChain for a Spring application. A configuration method receives it from Spring, applies security rules, and finishes with http.build(). section 17.3.1
Listing 17.7 Configuring endpoint authorization for reactive apps
@Configuration
public class ProjectConfig {
// Omitted code
@Bean
public SecurityWebFilterChain securityWebFilterChain(
ServerHttpSecurity http) {
http.httpBasic(Customizer.withDefaults());
http.authorizeExchange( #1
c -> c.pathMatchers(HttpMethod.GET, "/hello") #2
.authenticated() #3
.anyExchange() #4
.permitAll() #5
);
return http.build(); #6
}
}
Use the annotated configuration listing to follow the complete flow: enable HTTP Basic authentication, match GET /hello, require authentication, permit other exchanges, and build the filter chain. section 17.3.1
Configure authorization rules through a reactive, fluent API:
- Call authorizeExchange() to begin endpoint authorization configuration. section 17.3.1
- Use pathMatchers() to select requests, then apply authenticated(), permitAll(), denyAll(), hasRole(), hasAnyRole(), hasAuthority(), or hasAnyAuthority(). section 17.3.1
- Use access() when authorization requires a custom decision based on authentication and request context. section 17.3.1
Protecting one reactive endpoint
A SecurityWebFilterChain can enable HTTP Basic authentication, require authentication for GET /hello, permit all other exchanges, and return http.build(). A request such as curl -u john:12345 http://localhost:8080/hello then produces Hello john. section 17.3.1
