Spring security requests authorization

Question

I am new to spring security and was checking how to authorize requests to URLs in my application.

According to the documentation here, we add authorization as follow:

protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() .antMatchers("/resources/**", "/signup", "/about").permitAll() .antMatchers("/admin/**").hasRole("ADMIN") .antMatchers("/db/**").access("hasRole('ADMIN') and hasRole('DBA')") .anyRequest().authenticated() .and() // ... .formLogin(); }

As this method worked fine for me, I was wondering if there's another dynamic way to specify this configuration. By using some sort of annotations for our REST controllers for example?

I have a solution in mind that would be really practical, but I wanted to make sure that there's no other way to do this before starting to develop my own code.

Thank you for your help.

Yogendra Mishra · Accepted Answer · 2018-07-26 10:26:05Z

Yes there is an annotations as @Secured/@PreAuthorize/@PostAuthorize. this annotations are preferred way for applying method-level security, and supports Spring Expression Language out of the box, and provide expression-based access control.

for e.g

@PreAuthorize("hasRole('ADMIN')") public String yourControllerMethod() { return response; }

for detail check here.

Oreste Viron · Accepted Answer · 2018-07-26 10:19:55Z

The only other way is to use the @Secured/@PreAuthorize/@PostAuthorize annotations. But you must put them on all webservices you want to secure.

Usually, when I build a webservices application, I like to authorize all requests on the WebSecurityConfigurerAdapter, and then secure requests one by one with these annotations.

Collectives™ on Stack Overflow

Spring security requests authorization

2 Answers 2

Comments

Comments

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Related