Package org.springframework.security.config.annotation.web.configurers

Class UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>

java.lang.Object
org.springframework.security.config.annotation.SecurityConfigurerAdapter<DefaultSecurityFilterChain,B>
org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer<C,H>
org.springframework.security.config.annotation.web.configurers.AbstractInterceptUrlConfigurer<UrlAuthorizationConfigurer<H>,H>
org.springframework.security.config.annotation.web.configurers.UrlAuthorizationConfigurer<H>
Type Parameters:
H - the type of HttpSecurityBuilder that is being configured
All Implemented Interfaces:
SecurityConfigurer<DefaultSecurityFilterChain,H>
@Deprecated public final class UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>> extends AbstractInterceptUrlConfigurer<UrlAuthorizationConfigurer<H>,H>
Deprecated.
Use AuthorizeHttpRequestsConfigurer instead
Adds URL based authorization using DefaultFilterInvocationSecurityMetadataSource. At least one RequestMapping needs to be mapped to ConfigAttribute's for this SecurityContextConfigurer to have meaning.

Security Filters

Usage includes applying the UrlAuthorizationConfigurer and then modifying the StandardInterceptUrlRegistry. For example: 

 @Bean
 public SecurityFilterChain filterChain(HttpSecurity http, ApplicationContext context) throws Exception {
        http.apply(new UrlAuthorizationConfigurer<HttpSecurity>(context)).getRegistry()
                        .requestMatchers("/users**", "/sessions/**").hasRole("USER")
                        .requestMatchers("/signup").hasRole("ANONYMOUS").anyRequest().hasRole("USER");
 }
The following Filters are populated

Shared Objects Created

The following shared objects are populated to allow other SecurityConfigurer's to customize:

Shared Objects Used

The following shared objects are used:
  • AuthenticationManager
Since:
3.2
See Also: