Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-05-31 01:02:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove deprecated RequestMatcher methods from Java Configuration

Browse Source 
Closes gh-11939
This commit is contained in:
Marcus Da Coregio 2022-10-05 13:29:47 -03:00
parent 9fd195d419
commit 398f5dee7f
57 changed files with 382 additions and 1308 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

118
config/src/main/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistry.java
View File

@ -89,90 +89,6 @@ public abstract class AbstractRequestMatcherRegistry<C> {
return configurer; return configurer;
} }
/**
* Maps a {@link List} of
* {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher}
* instances.
* @param method the {@link HttpMethod} to use for any {@link HttpMethod}.
* @return the object that is chained after creating the {@link RequestMatcher}
* @deprecated use {@link #requestMatchers(HttpMethod)} instead
*/
@Deprecated
public C antMatchers(HttpMethod method) {
return antMatchers(method, "/**");
}
/**
* Maps a {@link List} of
* {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher}
* instances.
* @param method the {@link HttpMethod} to use or {@code null} for any
* {@link HttpMethod}.
* @param antPatterns the ant patterns to create. If {@code null} or empty, then
* matches on nothing.
* @return the object that is chained after creating the {@link RequestMatcher}
* @deprecated use {@link #requestMatchers(HttpMethod, String...)} instead
*/
@Deprecated
public C antMatchers(HttpMethod method, String... antPatterns) {
Assert.state(!this.anyRequestConfigured, "Can't configure antMatchers after anyRequest");
return chainRequestMatchers(RequestMatchers.antMatchers(method, antPatterns));
}
/**
* Maps a {@link List} of
* {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher}
* instances that do not care which {@link HttpMethod} is used.
* @param antPatterns the ant patterns to create
* {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher} from
* @return the object that is chained after creating the {@link RequestMatcher}
* @deprecated use {@link #requestMatchers(String...)} instead
*/
@Deprecated
public C antMatchers(String... antPatterns) {
Assert.state(!this.anyRequestConfigured, "Can't configure antMatchers after anyRequest");
return chainRequestMatchers(RequestMatchers.antMatchers(antPatterns));
}
/**
* <p>
* Maps an {@link MvcRequestMatcher} that does not care which {@link HttpMethod} is
* used. This matcher will use the same rules that Spring MVC uses for matching. For
* example, often times a mapping of the path "/path" will match on "/path", "/path/",
* "/path.html", etc.
* </p>
* <p>
* If the current request will not be processed by Spring MVC, a reasonable default
* using the pattern as a ant pattern will be used.
* </p>
* @param mvcPatterns the patterns to match on. The rules for matching are defined by
* Spring MVC
* @return the object that is chained after creating the {@link RequestMatcher}.
* @deprecated use {@link #requestMatchers(String...)} instead
*/
@Deprecated
public abstract C mvcMatchers(String... mvcPatterns);
/**
* <p>
* Maps an {@link MvcRequestMatcher} that also specifies a specific {@link HttpMethod}
* to match on. This matcher will use the same rules that Spring MVC uses for
* matching. For example, often times a mapping of the path "/path" will match on
* "/path", "/path/", "/path.html", etc.
* </p>
* <p>
* If the current request will not be processed by Spring MVC, a reasonable default
* using the pattern as a ant pattern will be used.
* </p>
* @param method the HTTP method to match on
* @param mvcPatterns the patterns to match on. The rules for matching are defined by
* Spring MVC
* @return the object that is chained after creating the {@link RequestMatcher}.
* @deprecated use {@link #requestMatchers(HttpMethod, String...)} instead
*/
@Deprecated
public abstract C mvcMatchers(HttpMethod method, String... mvcPatterns);
/** /**
* Creates {@link MvcRequestMatcher} instances for the method and patterns passed in * Creates {@link MvcRequestMatcher} instances for the method and patterns passed in
* @param method the HTTP method to use or null if any should be used * @param method the HTTP method to use or null if any should be used
@ -201,40 +117,6 @@ public abstract class AbstractRequestMatcherRegistry<C> {
return matchers; return matchers;
} }
/**
* Maps a {@link List} of
* {@link org.springframework.security.web.util.matcher.RegexRequestMatcher}
* instances.
* @param method the {@link HttpMethod} to use or {@code null} for any
* {@link HttpMethod}.
* @param regexPatterns the regular expressions to create
* {@link org.springframework.security.web.util.matcher.RegexRequestMatcher} from
* @return the object that is chained after creating the {@link RequestMatcher}
* @deprecated use {@link #requestMatchers(RequestMatcher...)} with a
* {@link RegexRequestMatcher} instead
*/
@Deprecated
public C regexMatchers(HttpMethod method, String... regexPatterns) {
Assert.state(!this.anyRequestConfigured, "Can't configure regexMatchers after anyRequest");
return chainRequestMatchers(RequestMatchers.regexMatchers(method, regexPatterns));
}
/**
* Create a {@link List} of
* {@link org.springframework.security.web.util.matcher.RegexRequestMatcher} instances
* that do not specify an {@link HttpMethod}.
* @param regexPatterns the regular expressions to create
* {@link org.springframework.security.web.util.matcher.RegexRequestMatcher} from
* @return the object that is chained after creating the {@link RequestMatcher}
* @deprecated use {@link #requestMatchers(RequestMatcher...)} with a
* {@link RegexRequestMatcher} instead
*/
@Deprecated
public C regexMatchers(String... regexPatterns) {
Assert.state(!this.anyRequestConfigured, "Can't configure regexMatchers after anyRequest");
return chainRequestMatchers(RequestMatchers.regexMatchers(regexPatterns));
}
/** /**
* Maps a {@link List} of * Maps a {@link List} of
* {@link org.springframework.security.web.util.matcher.DispatcherTypeRequestMatcher} * {@link org.springframework.security.web.util.matcher.DispatcherTypeRequestMatcher}

510
config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java
View File

@ -32,7 +32,6 @@ import org.springframework.beans.factory.NoSuchBeanDefinitionException;
import org.springframework.context.ApplicationContext; import org.springframework.context.ApplicationContext;
import org.springframework.core.OrderComparator; import org.springframework.core.OrderComparator;
import org.springframework.core.Ordered; import org.springframework.core.Ordered;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationProvider; import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.config.Customizer; import org.springframework.security.config.Customizer;
@ -89,7 +88,6 @@ import org.springframework.security.web.session.HttpSessionEventPublisher;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher; import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.AnyRequestMatcher; import org.springframework.security.web.util.matcher.AnyRequestMatcher;
import org.springframework.security.web.util.matcher.OrRequestMatcher; import org.springframework.security.web.util.matcher.OrRequestMatcher;
import org.springframework.security.web.util.matcher.RegexRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher; import org.springframework.security.web.util.matcher.RequestMatcher;
import org.springframework.util.Assert; import org.springframework.util.Assert;
import org.springframework.util.ClassUtils; import org.springframework.util.ClassUtils;
@ -587,7 +585,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* *
* &#064;Bean * &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin() * http.authorizeRequests().requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin()
* .permitAll().and() * .permitAll().and()
* // Example portMapper() configuration * // Example portMapper() configuration
* .portMapper().http(9090).mapsTo(9443).http(80).mapsTo(443); * .portMapper().http(9090).mapsTo(9443).http(80).mapsTo(443);
@ -688,7 +686,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* *
* &#064;Bean * &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and() * http.authorizeRequests().requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and()
* // Example jee() configuration * // Example jee() configuration
* .jee().mappableRoles(&quot;USER&quot;, &quot;ADMIN&quot;); * .jee().mappableRoles(&quot;USER&quot;, &quot;ADMIN&quot;);
* return http.build(); * return http.build();
@ -763,7 +761,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeRequests((authorizeRequests) -&gt; * .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests * authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* .jee((jee) -&gt; * .jee((jee) -&gt;
* jee * jee
@ -840,7 +838,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* *
* &#064;Bean * &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and() * http.authorizeRequests().requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and()
* // Example x509() configuration * // Example x509() configuration
* .x509(); * .x509();
* return http.build(); * return http.build();
@ -873,7 +871,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeRequests((authorizeRequests) -&gt; * .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests * authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* .x509(withDefaults()); * .x509(withDefaults());
* return http.build(); * return http.build();
@ -907,7 +905,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* *
* &#064;Bean * &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin() * http.authorizeRequests().requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin()
* .permitAll().and() * .permitAll().and()
* // Example Remember Me Configuration * // Example Remember Me Configuration
* .rememberMe(); * .rememberMe();
@ -952,7 +950,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeRequests((authorizeRequests) -&gt; * .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests * authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* .formLogin(withDefaults()) * .formLogin(withDefaults())
* .rememberMe(withDefaults()); * .rememberMe(withDefaults());
@ -998,7 +996,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* *
* &#064;Bean * &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin(); * http.authorizeRequests().requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin();
* return http.build(); * return http.build();
* } * }
* *
@ -1030,8 +1028,8 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* *
* &#064;Bean * &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers(&quot;/admin/**&quot;).hasRole(&quot;ADMIN&quot;) * http.authorizeRequests().requestMatchers(&quot;/admin/**&quot;).hasRole(&quot;ADMIN&quot;)
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin(); * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin();
* return http.build(); * return http.build();
* } * }
* *
@ -1063,7 +1061,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* *
* &#064;Bean * &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).antMatchers(&quot;/admin/**&quot;) * http.authorizeRequests().requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).requestMatchers(&quot;/admin/**&quot;)
* .hasRole(&quot;ADMIN&quot;) * .hasRole(&quot;ADMIN&quot;)
* return http.build(); * return http.build();
* } * }
@ -1072,7 +1070,6 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* @return the {@link ExpressionUrlAuthorizationConfigurer} for further customizations * @return the {@link ExpressionUrlAuthorizationConfigurer} for further customizations
* @throws Exception * @throws Exception
* @deprecated Use {@link #authorizeHttpRequests()} instead * @deprecated Use {@link #authorizeHttpRequests()} instead
* @see #requestMatcher(RequestMatcher)
*/ */
@Deprecated @Deprecated
public ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry authorizeRequests() public ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry authorizeRequests()
@ -1101,7 +1098,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeRequests((authorizeRequests) -&gt; * .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests * authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* .formLogin(withDefaults()); * .formLogin(withDefaults());
* return http.build(); * return http.build();
@ -1138,8 +1135,8 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeRequests((authorizeRequests) -&gt; * .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests * authorizeRequests
* .antMatchers(&quot;/admin/**&quot;).hasRole(&quot;ADMIN&quot;) * .requestMatchers(&quot;/admin/**&quot;).hasRole(&quot;ADMIN&quot;)
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* .formLogin(withDefaults()); * .formLogin(withDefaults());
* return http.build(); * return http.build();
@ -1176,8 +1173,8 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeRequests((authorizeRequests) -&gt; * .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests * authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* .antMatchers(&quot;/admin/**&quot;).hasRole(&quot;ADMIN&quot;) * .requestMatchers(&quot;/admin/**&quot;).hasRole(&quot;ADMIN&quot;)
* ); * );
* return http.build(); * return http.build();
* } * }
@ -1188,7 +1185,6 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* @return the {@link HttpSecurity} for further customizations * @return the {@link HttpSecurity} for further customizations
* @throws Exception * @throws Exception
* @deprecated Use {@link #authorizeHttpRequests} instead * @deprecated Use {@link #authorizeHttpRequests} instead
* @see #requestMatcher(RequestMatcher)
*/ */
@Deprecated @Deprecated
public HttpSecurity authorizeRequests( public HttpSecurity authorizeRequests(
@ -1219,7 +1215,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http * http
* .authorizeHttpRequests() * .authorizeHttpRequests()
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* .and() * .and()
* .formLogin(); * .formLogin();
* return http.build(); * return http.build();
@ -1255,8 +1251,8 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http * http
* .authorizeHttpRequests() * .authorizeHttpRequests()
* .antMatchers(&quot;/admin&quot;).hasRole(&quot;ADMIN&quot;) * .requestMatchers(&quot;/admin&quot;).hasRole(&quot;ADMIN&quot;)
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* .and() * .and()
* .formLogin(); * .formLogin();
* return http.build(); * return http.build();
@ -1292,8 +1288,8 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http * http
* .authorizeHttpRequests() * .authorizeHttpRequests()
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* .antMatchers(&quot;/admin/**&quot;).hasRole(&quot;ADMIN&quot;) * .requestMatchers(&quot;/admin/**&quot;).hasRole(&quot;ADMIN&quot;)
* .and() * .and()
* .formLogin(); * .formLogin();
* return http.build(); * return http.build();
@ -1303,7 +1299,6 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* @return the {@link HttpSecurity} for further customizations * @return the {@link HttpSecurity} for further customizations
* @throws Exception * @throws Exception
* @since 5.6 * @since 5.6
* @see #requestMatcher(RequestMatcher)
*/ */
public AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry authorizeHttpRequests() public AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry authorizeHttpRequests()
throws Exception { throws Exception {
@ -1331,7 +1326,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeHttpRequests((authorizeHttpRequests) -&gt; * .authorizeHttpRequests((authorizeHttpRequests) -&gt;
* authorizeHttpRequests * authorizeHttpRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* .formLogin(withDefaults()); * .formLogin(withDefaults());
* return http.build(); * return http.build();
@ -1368,8 +1363,8 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeHttpRequests((authorizeHttpRequests) -&gt; * .authorizeHttpRequests((authorizeHttpRequests) -&gt;
* authorizeHttpRequests * authorizeHttpRequests
* .antMatchers(&quot;/admin/**&quot;).hasRole(&quot;ADMIN&quot;) * .requestMatchers(&quot;/admin/**&quot;).hasRole(&quot;ADMIN&quot;)
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* .formLogin(withDefaults()); * .formLogin(withDefaults());
* return http.build(); * return http.build();
@ -1406,8 +1401,8 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeHttpRequests((authorizeHttpRequests) -&gt; * .authorizeHttpRequests((authorizeHttpRequests) -&gt;
* authorizeHttpRequests * authorizeHttpRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* .antMatchers(&quot;/admin/**&quot;).hasRole(&quot;ADMIN&quot;) * .requestMatchers(&quot;/admin/**&quot;).hasRole(&quot;ADMIN&quot;)
* ); * );
* return http.build(); * return http.build();
* } * }
@ -1418,7 +1413,6 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* @return the {@link HttpSecurity} for further customizations * @return the {@link HttpSecurity} for further customizations
* @throws Exception * @throws Exception
* @since 5.5 * @since 5.5
* @see #requestMatcher(RequestMatcher)
*/ */
public HttpSecurity authorizeHttpRequests( public HttpSecurity authorizeHttpRequests(
Customizer<AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry> authorizeHttpRequestsCustomizer) Customizer<AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry> authorizeHttpRequestsCustomizer)
@ -1463,7 +1457,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeRequests((authorizeRequests) -&gt; * .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests * authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* .requestCache((requestCache) -&gt; * .requestCache((requestCache) -&gt;
* requestCache.disable() * requestCache.disable()
@ -1512,7 +1506,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeRequests((authorizeRequests) -&gt; * .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests * authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* // sample exception handling customization * // sample exception handling customization
* .exceptionHandling((exceptionHandling) -&gt; * .exceptionHandling((exceptionHandling) -&gt;
@ -1695,7 +1689,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* *
* &#064;Bean * &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin() * http.authorizeRequests().requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin()
* .and() * .and()
* // sample logout customization * // sample logout customization
* .logout().deleteCookies(&quot;remove&quot;).invalidateHttpSession(false) * .logout().deleteCookies(&quot;remove&quot;).invalidateHttpSession(false)
@ -1744,7 +1738,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeRequests((authorizeRequests) -&gt; * .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests * authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* .formLogin(withDefaults()) * .formLogin(withDefaults())
* // sample logout customization * // sample logout customization
@ -1799,7 +1793,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http * http
* .authorizeRequests() * .authorizeRequests()
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* .and() * .and()
* .formLogin() * .formLogin()
* .and() * .and()
@ -1833,7 +1827,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http * http
* .authorizeRequests() * .authorizeRequests()
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* .and() * .and()
* .formLogin() * .formLogin()
* .and() * .and()
@ -1882,7 +1876,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeRequests((authorizeRequests) -&gt; * .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests * authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* .formLogin(withDefaults()) * .formLogin(withDefaults())
* // sample anonymous customization * // sample anonymous customization
@ -1919,7 +1913,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeRequests((authorizeRequests) -&gt; * .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests * authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* .formLogin(withDefaults()) * .formLogin(withDefaults())
* // sample anonymous customization * // sample anonymous customization
@ -1969,7 +1963,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* *
* &#064;Bean * &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin(); * http.authorizeRequests().requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin();
* return http.build(); * return http.build();
* } * }
* *
@ -1994,7 +1988,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* *
* &#064;Bean * &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin() * http.authorizeRequests().requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin()
* .usernameParameter(&quot;username&quot;) // default is username * .usernameParameter(&quot;username&quot;) // default is username
* .passwordParameter(&quot;password&quot;) // default is password * .passwordParameter(&quot;password&quot;) // default is password
* .loginPage(&quot;/authentication/login&quot;) // default is /login with an HTTP get * .loginPage(&quot;/authentication/login&quot;) // default is /login with an HTTP get
@ -2046,7 +2040,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeRequests((authorizeRequests) -&gt; * .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests * authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* .formLogin(withDefaults()); * .formLogin(withDefaults());
* return http.build(); * return http.build();
@ -2076,7 +2070,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeRequests((authorizeRequests) -&gt; * .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests * authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* .formLogin((formLogin) -&gt; * .formLogin((formLogin) -&gt;
* formLogin * formLogin
@ -2773,7 +2767,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* *
* &#064;Bean * &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin() * http.authorizeRequests().requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().formLogin()
* .and().requiresChannel().anyRequest().requiresSecure(); * .and().requiresChannel().anyRequest().requiresSecure();
* return http.build(); * return http.build();
* } * }
@ -2819,7 +2813,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeRequests((authorizeRequests) -&gt; * .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests * authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* .formLogin(withDefaults()) * .formLogin(withDefaults())
* .requiresChannel((requiresChannel) -&gt; * .requiresChannel((requiresChannel) -&gt;
@ -2869,7 +2863,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* *
* &#064;Bean * &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().httpBasic(); * http.authorizeRequests().requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;).and().httpBasic();
* return http.build(); * return http.build();
* } * }
* *
@ -2910,7 +2904,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeRequests((authorizeRequests) -&gt; * .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests * authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* .httpBasic(withDefaults()); * .httpBasic(withDefaults());
* return http.build(); * return http.build();
@ -2955,7 +2949,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* http * http
* .authorizeRequests(authorizeRequests -&gt; * .authorizeRequests(authorizeRequests -&gt;
* authorizeRequests * authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* ) * )
* .passwordManagement(passwordManagement -&gt; * .passwordManagement(passwordManagement -&gt;
* passwordManagement * passwordManagement
@ -3087,291 +3081,6 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
return addFilterAtOffsetOf(filter, 0, atFilter); return addFilterAtOffsetOf(filter, 0, atFilter);
} }
/**
* Allows specifying which {@link HttpServletRequest} instances this
* {@link HttpSecurity} will be invoked on. This method allows for easily invoking the
* {@link HttpSecurity} for multiple different {@link RequestMatcher} instances. If
* only a single {@link RequestMatcher} is necessary consider using
* {@link #mvcMatcher(String)}, {@link #antMatcher(String)},
* {@link #regexMatcher(String)}, or {@link #requestMatcher(RequestMatcher)}.
*
* <p>
* Invoking {@link #requestMatchers()} will not override previous invocations of
* {@link #mvcMatcher(String)}}, {@link #requestMatchers()},
* {@link #antMatcher(String)}, {@link #regexMatcher(String)}, and
* {@link #requestMatcher(RequestMatcher)}.
* </p>
*
* <h3>Example Configurations</h3>
*
* The following configuration enables the {@link HttpSecurity} for URLs that begin
* with "/api/" or "/oauth/".
*
* <pre>
* &#064;Configuration
* &#064;EnableWebSecurity
* public class RequestMatchersSecurityConfig {
*
* &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .requestMatchers()
* .antMatchers(&quot;/api/**&quot;, &quot;/oauth/**&quot;)
* .and()
* .authorizeRequests()
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* .and()
* .httpBasic();
* return http.build();
* }
*
* &#064;Bean
* public UserDetailsService userDetailsService() {
* UserDetails user = User.withDefaultPasswordEncoder()
* .username(&quot;user&quot;)
* .password(&quot;password&quot;)
* .roles(&quot;USER&quot;)
* .build();
* return new InMemoryUserDetailsManager(user);
* }
* }
* </pre>
*
* The configuration below is the same as the previous configuration.
*
* <pre>
* &#064;Configuration
* &#064;EnableWebSecurity
* public class RequestMatchersSecurityConfig {
*
* &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .requestMatchers()
* .antMatchers(&quot;/api/**&quot;)
* .antMatchers(&quot;/oauth/**&quot;)
* .and()
* .authorizeRequests()
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* .and()
* .httpBasic();
* return http.build();
* }
*
* &#064;Bean
* public UserDetailsService userDetailsService() {
* UserDetails user = User.withDefaultPasswordEncoder()
* .username(&quot;user&quot;)
* .password(&quot;password&quot;)
* .roles(&quot;USER&quot;)
* .build();
* return new InMemoryUserDetailsManager(user);
* }
* }
* </pre>
*
* The configuration below is also the same as the above configuration.
*
* <pre>
* &#064;Configuration
* &#064;EnableWebSecurity
* public class RequestMatchersSecurityConfig {
*
* &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .requestMatchers()
* .antMatchers(&quot;/api/**&quot;)
* .and()
* .requestMatchers()
* .antMatchers(&quot;/oauth/**&quot;)
* .and()
* .authorizeRequests()
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* .and()
* .httpBasic();
* return http.build();
* }
*
* &#064;Bean
* public UserDetailsService userDetailsService() {
* UserDetails user = User.withDefaultPasswordEncoder()
* .username(&quot;user&quot;)
* .password(&quot;password&quot;)
* .roles(&quot;USER&quot;)
* .build();
* return new InMemoryUserDetailsManager(user);
* }
* }
* </pre>
* @return the {@link RequestMatcherConfigurer} for further customizations
* @deprecated use {@link #securityMatchers()} instead
*/
@Deprecated
public RequestMatcherConfigurer requestMatchers() {
return this.requestMatcherConfigurer;
}
/**
* Allows specifying which {@link HttpServletRequest} instances this
* {@link HttpSecurity} will be invoked on. This method allows for easily invoking the
* {@link HttpSecurity} for multiple different {@link RequestMatcher} instances. If
* only a single {@link RequestMatcher} is necessary consider using
* {@link #mvcMatcher(String)}, {@link #antMatcher(String)},
* {@link #regexMatcher(String)}, or {@link #requestMatcher(RequestMatcher)}.
*
* <p>
* Invoking {@link #requestMatchers()} will not override previous invocations of
* {@link #mvcMatcher(String)}}, {@link #requestMatchers()},
* {@link #antMatcher(String)}, {@link #regexMatcher(String)}, and
* {@link #requestMatcher(RequestMatcher)}.
* </p>
*
* <h3>Example Configurations</h3>
*
* The following configuration enables the {@link HttpSecurity} for URLs that begin
* with "/api/" or "/oauth/".
*
* <pre>
* &#064;Configuration
* &#064;EnableWebSecurity
* public class RequestMatchersSecurityConfig {
*
* &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .requestMatchers((requestMatchers) -&gt;
* requestMatchers
* .antMatchers(&quot;/api/**&quot;, &quot;/oauth/**&quot;)
* )
* .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* )
* .httpBasic(withDefaults());
* return http.build();
* }
*
* &#064;Bean
* public UserDetailsService userDetailsService() {
* UserDetails user = User.withDefaultPasswordEncoder()
* .username(&quot;user&quot;)
* .password(&quot;password&quot;)
* .roles(&quot;USER&quot;)
* .build();
* return new InMemoryUserDetailsManager(user);
* }
* }
* </pre>
*
* The configuration below is the same as the previous configuration.
*
* <pre>
* &#064;Configuration
* &#064;EnableWebSecurity
* public class RequestMatchersSecurityConfig {
*
* &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .requestMatchers((requestMatchers) -&gt;
* requestMatchers
* .antMatchers(&quot;/api/**&quot;)
* .antMatchers(&quot;/oauth/**&quot;)
* )
* .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* )
* .httpBasic(withDefaults());
* return http.build();
* }
*
* &#064;Bean
* public UserDetailsService userDetailsService() {
* UserDetails user = User.withDefaultPasswordEncoder()
* .username(&quot;user&quot;)
* .password(&quot;password&quot;)
* .roles(&quot;USER&quot;)
* .build();
* return new InMemoryUserDetailsManager(user);
* }
* }
* </pre>
*
* The configuration below is also the same as the above configuration.
*
* <pre>
* &#064;Configuration
* &#064;EnableWebSecurity
* public class RequestMatchersSecurityConfig {
*
* &#064;Bean
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .requestMatchers((requestMatchers) -&gt;
* requestMatchers
* .antMatchers(&quot;/api/**&quot;)
* )
* .requestMatchers((requestMatchers) -&gt;
* requestMatchers
* .antMatchers(&quot;/oauth/**&quot;)
* )
* .authorizeRequests((authorizeRequests) -&gt;
* authorizeRequests
* .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
* )
* .httpBasic(withDefaults());
* return http.build();
* }
*
* &#064;Bean
* public UserDetailsService userDetailsService() {
* UserDetails user = User.withDefaultPasswordEncoder()
* .username(&quot;user&quot;)
* .password(&quot;password&quot;)
* .roles(&quot;USER&quot;)
* .build();
* return new InMemoryUserDetailsManager(user);
* }
* }
* </pre>
* @param requestMatcherCustomizer the {@link Customizer} to provide more options for
* the {@link RequestMatcherConfigurer}
* @return the {@link HttpSecurity} for further customizations
* @deprecated use {@link #securityMatchers(Customizer)} instead
*/
@Deprecated
public HttpSecurity requestMatchers(Customizer<RequestMatcherConfigurer> requestMatcherCustomizer) {
requestMatcherCustomizer.customize(this.requestMatcherConfigurer);
return HttpSecurity.this;
}
/**
* Allows configuring the {@link HttpSecurity} to only be invoked when matching the
* provided {@link RequestMatcher}. If more advanced configuration is necessary,
* consider using {@link #requestMatchers()}.
*
* <p>
* Invoking {@link #requestMatcher(RequestMatcher)} will override previous invocations
* of {@link #requestMatchers()}, {@link #mvcMatcher(String)},
* {@link #antMatcher(String)}, {@link #regexMatcher(String)}, and
* {@link #requestMatcher(RequestMatcher)}.
* </p>
* @param requestMatcher the {@link RequestMatcher} to use (i.e. new
* AntPathRequestMatcher("/admin/**","GET") )
* @return the {@link HttpSecurity} for further customizations
* @deprecated use {@link #securityMatcher(RequestMatcher)} instead
* @see #requestMatchers()
* @see #antMatcher(String)
* @see #regexMatcher(String)
*/
@Deprecated
public HttpSecurity requestMatcher(RequestMatcher requestMatcher) {
this.requestMatcher = requestMatcher;
return this;
}
/** /**
* Allows specifying which {@link HttpServletRequest} instances this * Allows specifying which {@link HttpServletRequest} instances this
* {@link HttpSecurity} will be invoked on. This method allows for easily invoking the * {@link HttpSecurity} will be invoked on. This method allows for easily invoking the
@ -3624,10 +3333,9 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* *
* <p> * <p>
* Invoking {@link #securityMatcher(RequestMatcher)} will override previous * Invoking {@link #securityMatcher(RequestMatcher)} will override previous
* invocations of {@link #requestMatchers()}, {@link #mvcMatcher(String)}, * invocations of {@link #securityMatcher(RequestMatcher)},
* {@link #antMatcher(String)}, {@link #regexMatcher(String)}, * {@link #securityMatcher(String...)}, {@link #securityMatchers(Customizer)} and
* {@link #requestMatcher(RequestMatcher)}, {@link #securityMatchers(Customizer)}, * {@link #securityMatchers()}
* {@link #securityMatchers()} and {@link #securityMatcher(String...)}
* </p> * </p>
* @param requestMatcher the {@link RequestMatcher} to use (i.e. new * @param requestMatcher the {@link RequestMatcher} to use (i.e. new
* AntPathRequestMatcher("/admin/**","GET") ) * AntPathRequestMatcher("/admin/**","GET") )
@ -3648,9 +3356,9 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
* *
* <p> * <p>
* Invoking {@link #securityMatcher(String...)} will override previous invocations of * Invoking {@link #securityMatcher(String...)} will override previous invocations of
* {@link #mvcMatcher(String)}}, {@link #requestMatchers()}, * {@link #securityMatcher(String...)} (String)}},
* {@link #antMatcher(String)}, {@link #regexMatcher(String)}, and * {@link #securityMatcher(RequestMatcher)} ()}, {@link #securityMatchers(Customizer)}
* {@link #requestMatcher(RequestMatcher)}. * (String)} and {@link #securityMatchers()} (String)}.
* </p> * </p>
* @param patterns the pattern to match on (i.e. "/admin/**") * @param patterns the pattern to match on (i.e. "/admin/**")
* @return the {@link HttpSecurity} for further customizations * @return the {@link HttpSecurity} for further customizations
@ -3692,72 +3400,6 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
return matchers; return matchers;
} }
/**
* Allows configuring the {@link HttpSecurity} to only be invoked when matching the
* provided ant pattern. If more advanced configuration is necessary, consider using
* {@link #requestMatchers()} or {@link #requestMatcher(RequestMatcher)}.
*
* <p>
* Invoking {@link #antMatcher(String)} will override previous invocations of
* {@link #mvcMatcher(String)}}, {@link #requestMatchers()},
* {@link #antMatcher(String)}, {@link #regexMatcher(String)}, and
* {@link #requestMatcher(RequestMatcher)}.
* </p>
* @param antPattern the Ant Pattern to match on (i.e. "/admin/**")
* @return the {@link HttpSecurity} for further customizations
* @deprecated use {@link #securityMatcher(String...)} instead
* @see AntPathRequestMatcher
*/
@Deprecated
public HttpSecurity antMatcher(String antPattern) {
return requestMatcher(new AntPathRequestMatcher(antPattern));
}
/**
* Allows configuring the {@link HttpSecurity} to only be invoked when matching the
* provided Spring MVC pattern. If more advanced configuration is necessary, consider
* using {@link #requestMatchers()} or {@link #requestMatcher(RequestMatcher)}.
*
* <p>
* Invoking {@link #mvcMatcher(String)} will override previous invocations of
* {@link #mvcMatcher(String)}}, {@link #requestMatchers()},
* {@link #antMatcher(String)}, {@link #regexMatcher(String)}, and
* {@link #requestMatcher(RequestMatcher)}.
* </p>
* @param mvcPattern the Spring MVC Pattern to match on (i.e. "/admin/**")
* @return the {@link HttpSecurity} for further customizations
* @deprecated use {@link #securityMatcher(String...)} instead
* @see MvcRequestMatcher
*/
@Deprecated
public HttpSecurity mvcMatcher(String mvcPattern) {
HandlerMappingIntrospector introspector = new HandlerMappingIntrospector();
introspector.setApplicationContext(getContext());
introspector.afterPropertiesSet();
return requestMatcher(new MvcRequestMatcher(introspector, mvcPattern));
}
/**
* Allows configuring the {@link HttpSecurity} to only be invoked when matching the
* provided regex pattern. If more advanced configuration is necessary, consider using
* {@link #requestMatchers()} or {@link #requestMatcher(RequestMatcher)}.
*
* <p>
* Invoking {@link #regexMatcher(String)} will override previous invocations of
* {@link #mvcMatcher(String)}}, {@link #requestMatchers()},
* {@link #antMatcher(String)}, {@link #regexMatcher(String)}, and
* {@link #requestMatcher(RequestMatcher)}.
* </p>
* @param pattern the Regular Expression to match on (i.e. "/admin/.+")
* @return the {@link HttpSecurity} for further customizations
* @deprecated use {@link #securityMatcher(RequestMatcher)} with a
* {@link RegexRequestMatcher} instead
*/
@Deprecated
public HttpSecurity regexMatcher(String pattern) {
return requestMatcher(new RegexRequestMatcher(pattern, null));
}
/** /**
* If the {@link SecurityConfigurer} has already been specified get the original, * If the {@link SecurityConfigurer} has already been specified get the original,
* otherwise apply the new {@link SecurityConfigurerAdapter}. * otherwise apply the new {@link SecurityConfigurerAdapter}.
@ -3776,40 +3418,6 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
return apply(configurer); return apply(configurer);
} }
/**
* An extension to {@link RequestMatcherConfigurer} that allows optionally configuring
* the servlet path.
*
* @author Rob Winch
*/
public final class MvcMatchersRequestMatcherConfigurer extends RequestMatcherConfigurer {
private final List<MvcRequestMatcher> mvcMatchers;
/**
* Creates a new instance
* @param context the {@link ApplicationContext} to use
* @param mvcMatchers the {@link MvcRequestMatcher} instances to set the servlet
* path on if {@link #servletPath(String)} is set.
* @param allMatchers the {@link RequestMatcher} instances to continue the
* configuration
*/
private MvcMatchersRequestMatcherConfigurer(ApplicationContext context, List<MvcRequestMatcher> mvcMatchers,
List<RequestMatcher> allMatchers) {
super(context);
this.mvcMatchers = new ArrayList<>(mvcMatchers);
this.matchers = allMatchers;
}
public RequestMatcherConfigurer servletPath(String servletPath) {
for (MvcRequestMatcher matcher : this.mvcMatchers) {
matcher.setServletPath(servletPath);
}
return this;
}
}
/** /**
* Allows mapping HTTP requests that this {@link HttpSecurity} will be used for * Allows mapping HTTP requests that this {@link HttpSecurity} will be used for
* *
@ -3824,26 +3432,6 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
setApplicationContext(context); setApplicationContext(context);
} }
/**
* @deprecated use {@link #requestMatchers(HttpMethod, String...)} instead
*/
@Override
@Deprecated
public MvcMatchersRequestMatcherConfigurer mvcMatchers(HttpMethod method, String... mvcPatterns) {
List<MvcRequestMatcher> mvcMatchers = createMvcMatchers(method, mvcPatterns);
setMatchers(mvcMatchers);
return new MvcMatchersRequestMatcherConfigurer(getContext(), mvcMatchers, this.matchers);
}
/**
* @deprecated use {@link #requestMatchers(String...)} instead
*/
@Override
@Deprecated
public MvcMatchersRequestMatcherConfigurer mvcMatchers(String... patterns) {
return mvcMatchers(null, patterns);
}
@Override @Override
protected RequestMatcherConfigurer chainRequestMatchers(List<RequestMatcher> requestMatchers) { protected RequestMatcherConfigurer chainRequestMatchers(List<RequestMatcher> requestMatchers) {
setMatchers(requestMatchers); setMatchers(requestMatchers);

48
config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java
View File

@ -29,7 +29,6 @@ import org.springframework.beans.BeansException;
import org.springframework.beans.factory.NoSuchBeanDefinitionException; import org.springframework.beans.factory.NoSuchBeanDefinitionException;
import org.springframework.context.ApplicationContext; import org.springframework.context.ApplicationContext;
import org.springframework.context.ApplicationContextAware; import org.springframework.context.ApplicationContextAware;
import org.springframework.http.HttpMethod;
import org.springframework.security.access.PermissionEvaluator; import org.springframework.security.access.PermissionEvaluator;
import org.springframework.security.access.expression.SecurityExpressionHandler; import org.springframework.security.access.expression.SecurityExpressionHandler;
import org.springframework.security.access.hierarchicalroles.RoleHierarchy; import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
@ -58,7 +57,6 @@ import org.springframework.security.web.debug.DebugFilter;
import org.springframework.security.web.firewall.HttpFirewall; import org.springframework.security.web.firewall.HttpFirewall;
import org.springframework.security.web.firewall.RequestRejectedHandler; import org.springframework.security.web.firewall.RequestRejectedHandler;
import org.springframework.security.web.firewall.StrictHttpFirewall; import org.springframework.security.web.firewall.StrictHttpFirewall;
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher; import org.springframework.security.web.util.matcher.RequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcherEntry; import org.springframework.security.web.util.matcher.RequestMatcherEntry;
import org.springframework.util.Assert; import org.springframework.util.Assert;
@ -375,32 +373,6 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
this.servletContext = servletContext; this.servletContext = servletContext;
} }
/**
* An {@link IgnoredRequestConfigurer} that allows optionally configuring the
* {@link MvcRequestMatcher#setMethod(HttpMethod)}
*
* @author Rob Winch
* @deprecated use {@link MvcRequestMatcher.Builder} instead
*/
@Deprecated
public final class MvcMatchersIgnoredRequestConfigurer extends IgnoredRequestConfigurer {
private final List<MvcRequestMatcher> mvcMatchers;
private MvcMatchersIgnoredRequestConfigurer(ApplicationContext context, List<MvcRequestMatcher> mvcMatchers) {
super(context);
this.mvcMatchers = mvcMatchers;
}
public IgnoredRequestConfigurer servletPath(String servletPath) {
for (MvcRequestMatcher matcher : this.mvcMatchers) {
matcher.setServletPath(servletPath);
}
return this;
}
}
/** /**
* Allows registering {@link RequestMatcher} instances that should be ignored by * Allows registering {@link RequestMatcher} instances that should be ignored by
* Spring Security. * Spring Security.
@ -414,26 +386,6 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
setApplicationContext(context); setApplicationContext(context);
} }
/**
* @deprecated use {@link #requestMatchers(HttpMethod, String...)} instead
*/
@Override
@Deprecated
public MvcMatchersIgnoredRequestConfigurer mvcMatchers(HttpMethod method, String... mvcPatterns) {
List<MvcRequestMatcher> mvcMatchers = createMvcMatchers(method, mvcPatterns);
WebSecurity.this.ignoredRequests.addAll(mvcMatchers);
return new MvcMatchersIgnoredRequestConfigurer(getApplicationContext(), mvcMatchers);
}
/**
* @deprecated use {@link #requestMatchers(String...)} instead
*/
@Override
@Deprecated
public MvcMatchersIgnoredRequestConfigurer mvcMatchers(String... mvcPatterns) {
return mvcMatchers(null, mvcPatterns);
}
@Override @Override
protected IgnoredRequestConfigurer chainRequestMatchers(List<RequestMatcher> requestMatchers) { protected IgnoredRequestConfigurer chainRequestMatchers(List<RequestMatcher> requestMatchers) {
WebSecurity.this.ignoredRequests.addAll(requestMatchers); WebSecurity.this.ignoredRequests.addAll(requestMatchers);

2
config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityCustomizer.java
View File

@ -29,7 +29,7 @@ import org.springframework.security.config.annotation.web.builders.WebSecurity;
* <pre> * <pre>
* &#064;Bean * &#064;Bean
* public WebSecurityCustomizer ignoringCustomizer() { * public WebSecurityCustomizer ignoringCustomizer() {
* return (web) -&gt; web.ignoring().antMatchers("/ignore1", "/ignore2"); * return (web) -&gt; web.ignoring().requestMatchers("/ignore1", "/ignore2");
* } * }
* </pre> * </pre>
* *

49
config/src/main/java/org/springframework/security/config/annotation/web/configurers/AuthorizeHttpRequestsConfigurer.java
View File

@ -21,7 +21,6 @@ import java.util.List;
import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletRequest;
import org.springframework.context.ApplicationContext; import org.springframework.context.ApplicationContext;
import org.springframework.http.HttpMethod;
import org.springframework.security.authorization.AuthenticatedAuthorizationManager; import org.springframework.security.authorization.AuthenticatedAuthorizationManager;
import org.springframework.security.authorization.AuthorityAuthorizationManager; import org.springframework.security.authorization.AuthorityAuthorizationManager;
import org.springframework.security.authorization.AuthorizationDecision; import org.springframework.security.authorization.AuthorizationDecision;
@ -34,7 +33,6 @@ import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
import org.springframework.security.web.access.intercept.AuthorizationFilter; import org.springframework.security.web.access.intercept.AuthorizationFilter;
import org.springframework.security.web.access.intercept.RequestAuthorizationContext; import org.springframework.security.web.access.intercept.RequestAuthorizationContext;
import org.springframework.security.web.access.intercept.RequestMatcherDelegatingAuthorizationManager; import org.springframework.security.web.access.intercept.RequestMatcherDelegatingAuthorizationManager;
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher; import org.springframework.security.web.util.matcher.RequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcherEntry; import org.springframework.security.web.util.matcher.RequestMatcherEntry;
import org.springframework.util.Assert; import org.springframework.util.Assert;
@ -146,24 +144,6 @@ public final class AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder
return postProcess(this.managerBuilder.build()); return postProcess(this.managerBuilder.build());
} }
/**
* @deprecated use {@link #requestMatchers(String...)} instead
*/
@Override
@Deprecated
public MvcMatchersAuthorizedUrl mvcMatchers(String... mvcPatterns) {
return mvcMatchers(null, mvcPatterns);
}
/**
* @deprecated use {@link #requestMatchers(HttpMethod, String...)} instead
*/
@Override
@Deprecated
public MvcMatchersAuthorizedUrl mvcMatchers(HttpMethod method, String... mvcPatterns) {
return new MvcMatchersAuthorizedUrl(createMvcMatchers(method, mvcPatterns));
}
@Override @Override
protected AuthorizedUrl chainRequestMatchers(List<RequestMatcher> requestMatchers) { protected AuthorizedUrl chainRequestMatchers(List<RequestMatcher> requestMatchers) {
this.unmappedMatchers = requestMatchers; this.unmappedMatchers = requestMatchers;
@ -205,35 +185,6 @@ public final class AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder
} }
/**
* An {@link AuthorizeHttpRequestsConfigurer.AuthorizedUrl} that allows optionally
* configuring the {@link MvcRequestMatcher#setServletPath(String)}.
*
* @author Evgeniy Cheban
* @deprecated use {@link MvcRequestMatcher.Builder} instead
*/
@Deprecated
public final class MvcMatchersAuthorizedUrl extends AuthorizedUrl {
private MvcMatchersAuthorizedUrl(List<MvcRequestMatcher> matchers) {
super(matchers);
}
/**
* Configures <code>servletPath</code> to {@link MvcRequestMatcher}s.
* @param servletPath the servlet path
* @return the {@link MvcMatchersAuthorizedUrl} for further customizations
*/
@SuppressWarnings("unchecked")
public MvcMatchersAuthorizedUrl servletPath(String servletPath) {
for (MvcRequestMatcher matcher : (List<MvcRequestMatcher>) getMatchers()) {
matcher.setServletPath(servletPath);
}
return this;
}
}
/** /**
* An object that allows configuring the {@link AuthorizationManager} for * An object that allows configuring the {@link AuthorizationManager} for
* {@link RequestMatcher}s. * {@link RequestMatcher}s.

36
config/src/main/java/org/springframework/security/config/annotation/web/configurers/ChannelSecurityConfigurer.java
View File

@ -22,7 +22,6 @@ import java.util.LinkedHashMap;
import java.util.List; import java.util.List;
import org.springframework.context.ApplicationContext; import org.springframework.context.ApplicationContext;
import org.springframework.http.HttpMethod;
import org.springframework.security.access.ConfigAttribute; import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.access.SecurityConfig; import org.springframework.security.access.SecurityConfig;
import org.springframework.security.config.annotation.ObjectPostProcessor; import org.springframework.security.config.annotation.ObjectPostProcessor;
@ -41,7 +40,6 @@ import org.springframework.security.web.access.channel.RetryWithHttpEntryPoint;
import org.springframework.security.web.access.channel.RetryWithHttpsEntryPoint; import org.springframework.security.web.access.channel.RetryWithHttpsEntryPoint;
import org.springframework.security.web.access.channel.SecureChannelProcessor; import org.springframework.security.web.access.channel.SecureChannelProcessor;
import org.springframework.security.web.access.intercept.DefaultFilterInvocationSecurityMetadataSource; import org.springframework.security.web.access.intercept.DefaultFilterInvocationSecurityMetadataSource;
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher; import org.springframework.security.web.util.matcher.RequestMatcher;
/** /**
@ -155,25 +153,6 @@ public final class ChannelSecurityConfigurer<H extends HttpSecurityBuilder<H>>
setApplicationContext(context); setApplicationContext(context);
} }
/**
* @deprecated use {@link #requestMatchers(HttpMethod, String...)} instead
*/
@Override
@Deprecated
public MvcMatchersRequiresChannelUrl mvcMatchers(HttpMethod method, String... mvcPatterns) {
List<MvcRequestMatcher> mvcMatchers = createMvcMatchers(method, mvcPatterns);
return new MvcMatchersRequiresChannelUrl(mvcMatchers);
}
/**
* @deprecated use {@link #requestMatchers(String...)} instead
*/
@Override
@Deprecated
public MvcMatchersRequiresChannelUrl mvcMatchers(String... patterns) {
return mvcMatchers(null, patterns);
}
@Override @Override
protected RequiresChannelUrl chainRequestMatchersInternal(List<RequestMatcher> requestMatchers) { protected RequiresChannelUrl chainRequestMatchersInternal(List<RequestMatcher> requestMatchers) {
return new RequiresChannelUrl(requestMatchers); return new RequiresChannelUrl(requestMatchers);
@ -222,21 +201,6 @@ public final class ChannelSecurityConfigurer<H extends HttpSecurityBuilder<H>>
} }
public final class MvcMatchersRequiresChannelUrl extends RequiresChannelUrl {
private MvcMatchersRequiresChannelUrl(List<MvcRequestMatcher> matchers) {
super(matchers);
}
public RequiresChannelUrl servletPath(String servletPath) {
for (RequestMatcher matcher : this.requestMatchers) {
((MvcRequestMatcher) matcher).setServletPath(servletPath);
}
return this;
}
}
public class RequiresChannelUrl { public class RequiresChannelUrl {
protected List<? extends RequestMatcher> requestMatchers; protected List<? extends RequestMatcher> requestMatchers;

78
config/src/main/java/org/springframework/security/config/annotation/web/configurers/CsrfConfigurer.java
View File

@ -23,7 +23,6 @@ import java.util.List;
import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletRequest;
import org.springframework.context.ApplicationContext; import org.springframework.context.ApplicationContext;
import org.springframework.http.HttpMethod;
import org.springframework.security.access.AccessDeniedException; import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry; import org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry;
import org.springframework.security.config.annotation.web.HttpSecurityBuilder; import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
@ -40,7 +39,6 @@ import org.springframework.security.web.csrf.CsrfTokenRequestHandler;
import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository; import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
import org.springframework.security.web.csrf.LazyCsrfTokenRepository; import org.springframework.security.web.csrf.LazyCsrfTokenRepository;
import org.springframework.security.web.csrf.MissingCsrfTokenException; import org.springframework.security.web.csrf.MissingCsrfTokenException;
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
import org.springframework.security.web.session.InvalidSessionAccessDeniedHandler; import org.springframework.security.web.session.InvalidSessionAccessDeniedHandler;
import org.springframework.security.web.session.InvalidSessionStrategy; import org.springframework.security.web.session.InvalidSessionStrategy;
import org.springframework.security.web.util.matcher.AndRequestMatcher; import org.springframework.security.web.util.matcher.AndRequestMatcher;
@ -139,37 +137,6 @@ public final class CsrfConfigurer<H extends HttpSecurityBuilder<H>>
return this; return this;
} }
/**
* <p>
* Allows specifying {@link HttpServletRequest} that should not use CSRF Protection
* even if they match the {@link #requireCsrfProtectionMatcher(RequestMatcher)}.
* </p>
*
* <p>
* For example, the following configuration will ensure CSRF protection ignores:
* </p>
* <ul>
* <li>Any GET, HEAD, TRACE, OPTIONS (this is the default)</li>
* <li>We also explicitly state to ignore any request that starts with "/sockjs/"</li>
* </ul>
*
* <pre>
* http
* .csrf()
* .ignoringAntMatchers("/sockjs/**")
* .and()
* ...
* </pre>
*
* @since 4.0
* @deprecated use {@link #ignoringRequestMatchers(RequestMatcher...)} with an
* {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher} instead
*/
@Deprecated
public CsrfConfigurer<H> ignoringAntMatchers(String... antPatterns) {
return new IgnoreCsrfProtectionRegistry(this.context).antMatchers(antPatterns).and();
}
/** /**
* <p> * <p>
* Allows specifying {@link HttpServletRequest}s that should not use CSRF Protection * Allows specifying {@link HttpServletRequest}s that should not use CSRF Protection
@ -378,26 +345,6 @@ public final class CsrfConfigurer<H extends HttpSecurityBuilder<H>>
setApplicationContext(context); setApplicationContext(context);
} }
/**
* @deprecated use {@link #requestMatchers(HttpMethod, String...)} instead
*/
@Override
@Deprecated
public MvcMatchersIgnoreCsrfProtectionRegistry mvcMatchers(HttpMethod method, String... mvcPatterns) {
List<MvcRequestMatcher> mvcMatchers = createMvcMatchers(method, mvcPatterns);
CsrfConfigurer.this.ignoredCsrfProtectionMatchers.addAll(mvcMatchers);
return new MvcMatchersIgnoreCsrfProtectionRegistry(getApplicationContext(), mvcMatchers);
}
/**
* @deprecated use {@link #requestMatchers(String...)} instead
*/
@Override
@Deprecated
public MvcMatchersIgnoreCsrfProtectionRegistry mvcMatchers(String... mvcPatterns) {
return mvcMatchers(null, mvcPatterns);
}
CsrfConfigurer<H> and() { CsrfConfigurer<H> and() {
return CsrfConfigurer.this; return CsrfConfigurer.this;
} }
@ -410,29 +357,4 @@ public final class CsrfConfigurer<H extends HttpSecurityBuilder<H>>
} }
/**
* An {@link IgnoreCsrfProtectionRegistry} that allows optionally configuring the
* {@link MvcRequestMatcher#setMethod(HttpMethod)}
*
* @author Rob Winch
*/
private final class MvcMatchersIgnoreCsrfProtectionRegistry extends IgnoreCsrfProtectionRegistry {
private final List<MvcRequestMatcher> mvcMatchers;
private MvcMatchersIgnoreCsrfProtectionRegistry(ApplicationContext context,
List<MvcRequestMatcher> mvcMatchers) {
super(context);
this.mvcMatchers = mvcMatchers;
}
IgnoreCsrfProtectionRegistry servletPath(String servletPath) {
for (MvcRequestMatcher matcher : this.mvcMatchers) {
matcher.setServletPath(servletPath);
}
return this;
}
}
} }

45
config/src/main/java/org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationConfigurer.java
View File

@ -22,7 +22,6 @@ import java.util.LinkedHashMap;
import java.util.List; import java.util.List;
import org.springframework.context.ApplicationContext; import org.springframework.context.ApplicationContext;
import org.springframework.http.HttpMethod;
import org.springframework.security.access.AccessDecisionVoter; import org.springframework.security.access.AccessDecisionVoter;
import org.springframework.security.access.ConfigAttribute; import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.access.PermissionEvaluator; import org.springframework.security.access.PermissionEvaluator;
@ -38,7 +37,6 @@ import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler; import org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler;
import org.springframework.security.web.access.expression.ExpressionBasedFilterInvocationSecurityMetadataSource; import org.springframework.security.web.access.expression.ExpressionBasedFilterInvocationSecurityMetadataSource;
import org.springframework.security.web.access.expression.WebExpressionVoter; import org.springframework.security.web.access.expression.WebExpressionVoter;
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher; import org.springframework.security.web.util.matcher.RequestMatcher;
import org.springframework.util.Assert; import org.springframework.util.Assert;
import org.springframework.util.StringUtils; import org.springframework.util.StringUtils;
@ -222,24 +220,6 @@ public final class ExpressionUrlAuthorizationConfigurer<H extends HttpSecurityBu
setApplicationContext(context); setApplicationContext(context);
} }
/**
* @deprecated use {@link #requestMatchers(HttpMethod, String...)} instead
*/
@Override
@Deprecated
public MvcMatchersAuthorizedUrl mvcMatchers(HttpMethod method, String... mvcPatterns) {
return new MvcMatchersAuthorizedUrl(createMvcMatchers(method, mvcPatterns));
}
/**
* @deprecated use {@link #requestMatchers(String...)} instead
*/
@Override
@Deprecated
public MvcMatchersAuthorizedUrl mvcMatchers(String... patterns) {
return mvcMatchers(null, patterns);
}
@Override @Override
protected AuthorizedUrl chainRequestMatchersInternal(List<RequestMatcher> requestMatchers) { protected AuthorizedUrl chainRequestMatchersInternal(List<RequestMatcher> requestMatchers) {
return new AuthorizedUrl(requestMatchers); return new AuthorizedUrl(requestMatchers);
@ -275,31 +255,6 @@ public final class ExpressionUrlAuthorizationConfigurer<H extends HttpSecurityBu
} }
/**
* An {@link AuthorizedUrl} that allows optionally configuring the
* {@link MvcRequestMatcher#setMethod(HttpMethod)}
*
* @author Rob Winch
*/
public final class MvcMatchersAuthorizedUrl extends AuthorizedUrl {
/**
* Creates a new instance
* @param requestMatchers the {@link RequestMatcher} instances to map
*/
private MvcMatchersAuthorizedUrl(List<MvcRequestMatcher> requestMatchers) {
super(requestMatchers);
}
public AuthorizedUrl servletPath(String servletPath) {
for (MvcRequestMatcher matcher : (List<MvcRequestMatcher>) getMatchers()) {
matcher.setServletPath(servletPath);
}
return this;
}
}
public class AuthorizedUrl { public class AuthorizedUrl {
private List<? extends RequestMatcher> requestMatchers; private List<? extends RequestMatcher> requestMatchers;

57
config/src/main/java/org/springframework/security/config/annotation/web/configurers/UrlAuthorizationConfigurer.java
View File

@ -32,7 +32,6 @@ import org.springframework.security.config.annotation.ObjectPostProcessor;
import org.springframework.security.config.annotation.web.HttpSecurityBuilder; import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
import org.springframework.security.web.access.intercept.DefaultFilterInvocationSecurityMetadataSource; import org.springframework.security.web.access.intercept.DefaultFilterInvocationSecurityMetadataSource;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource; import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher; import org.springframework.security.web.util.matcher.RequestMatcher;
import org.springframework.util.Assert; import org.springframework.util.Assert;
@ -51,8 +50,8 @@ import org.springframework.util.Assert;
* <pre> * <pre>
* protected void configure(HttpSecurity http) throws Exception { * protected void configure(HttpSecurity http) throws Exception {
* http.apply(new UrlAuthorizationConfigurer&lt;HttpSecurity&gt;()).getRegistry() * http.apply(new UrlAuthorizationConfigurer&lt;HttpSecurity&gt;()).getRegistry()
* .antMatchers(&quot;/users**&quot;, &quot;/sessions/**&quot;).hasRole(&quot;USER&quot;) * .requestMatchers(&quot;/users**&quot;, &quot;/sessions/**&quot;).hasRole(&quot;USER&quot;)
* .antMatchers(&quot;/signup&quot;).hasRole(&quot;ANONYMOUS&quot;).anyRequest().hasRole(&quot;USER&quot;); * .requestMatchers(&quot;/signup&quot;).hasRole(&quot;ANONYMOUS&quot;).anyRequest().hasRole(&quot;USER&quot;);
* } * }
* </pre> * </pre>
* *
@ -202,22 +201,24 @@ public final class UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>
setApplicationContext(context); setApplicationContext(context);
} }
/**
* @deprecated use {@link #requestMatchers(HttpMethod, String...)} instead
*/
@Override @Override
@Deprecated public AuthorizedUrl requestMatchers(String... patterns) {
public MvcMatchersAuthorizedUrl mvcMatchers(HttpMethod method, String... mvcPatterns) { return super.requestMatchers(patterns);
return new MvcMatchersAuthorizedUrl(createMvcMatchers(method, mvcPatterns));
} }
/**
* @deprecated use {@link #requestMatchers(String...)} instead
*/
@Override @Override
@Deprecated public AuthorizedUrl requestMatchers(HttpMethod method, String... patterns) {
public MvcMatchersAuthorizedUrl mvcMatchers(String... patterns) { return super.requestMatchers(method, patterns);
return mvcMatchers(null, patterns); }
@Override
public AuthorizedUrl requestMatchers(HttpMethod method) {
return super.requestMatchers(method);
}
@Override
public AuthorizedUrl requestMatchers(RequestMatcher... requestMatchers) {
return super.requestMatchers(requestMatchers);
} }
@Override @Override
@ -242,32 +243,6 @@ public final class UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>
} }
/**
* An {@link AuthorizedUrl} that allows optionally configuring the
* {@link MvcRequestMatcher#setMethod(HttpMethod)}
*
* @author Rob Winch
*/
public final class MvcMatchersAuthorizedUrl extends AuthorizedUrl {
/**
* Creates a new instance
* @param requestMatchers the {@link RequestMatcher} instances to map
*/
private MvcMatchersAuthorizedUrl(List<MvcRequestMatcher> requestMatchers) {
super(requestMatchers);
}
@SuppressWarnings("unchecked")
public AuthorizedUrl servletPath(String servletPath) {
for (MvcRequestMatcher matcher : (List<MvcRequestMatcher>) getMatchers()) {
matcher.setServletPath(servletPath);
}
return this;
}
}
/** /**
* Maps the specified {@link RequestMatcher} instances to {@link ConfigAttribute} * Maps the specified {@link RequestMatcher} instances to {@link ConfigAttribute}
* instances. * instances.

16
config/src/main/kotlin/org/springframework/security/config/annotation/web/AuthorizeHttpRequestsDsl.kt
View File

@ -26,9 +26,11 @@ import org.springframework.security.config.annotation.web.configurers.AuthorizeH
import org.springframework.security.core.Authentication import org.springframework.security.core.Authentication
import org.springframework.security.web.access.intercept.AuthorizationFilter import org.springframework.security.web.access.intercept.AuthorizationFilter
import org.springframework.security.web.access.intercept.RequestAuthorizationContext import org.springframework.security.web.access.intercept.RequestAuthorizationContext
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher
import org.springframework.security.web.util.matcher.AnyRequestMatcher import org.springframework.security.web.util.matcher.AnyRequestMatcher
import org.springframework.security.web.util.matcher.RequestMatcher import org.springframework.security.web.util.matcher.RequestMatcher
import org.springframework.util.ClassUtils import org.springframework.util.ClassUtils
import org.springframework.web.servlet.handler.HandlerMappingIntrospector
import java.util.function.Supplier import java.util.function.Supplier
/** /**
@ -43,6 +45,7 @@ class AuthorizeHttpRequestsDsl : AbstractRequestMatcherDsl() {
private val authorizationRules = mutableListOf<AuthorizationManagerRule>() private val authorizationRules = mutableListOf<AuthorizationManagerRule>()
private val HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME = "mvcHandlerMappingIntrospector"
private val HANDLER_MAPPING_INTROSPECTOR = "org.springframework.web.servlet.handler.HandlerMappingIntrospector" private val HANDLER_MAPPING_INTROSPECTOR = "org.springframework.web.servlet.handler.HandlerMappingIntrospector"
private val MVC_PRESENT = ClassUtils.isPresent( private val MVC_PRESENT = ClassUtils.isPresent(
HANDLER_MAPPING_INTROSPECTOR, HANDLER_MAPPING_INTROSPECTOR,
@ -244,10 +247,15 @@ class AuthorizeHttpRequestsDsl : AbstractRequestMatcherDsl() {
is MatcherAuthorizationManagerRule -> requests.requestMatchers(rule.matcher).access(rule.rule) is MatcherAuthorizationManagerRule -> requests.requestMatchers(rule.matcher).access(rule.rule)
is PatternAuthorizationManagerRule -> { is PatternAuthorizationManagerRule -> {
when (rule.patternType) { when (rule.patternType) {
PatternType.ANT -> requests.antMatchers(rule.httpMethod, rule.pattern).access(rule.rule) PatternType.ANT -> requests.requestMatchers(rule.httpMethod, rule.pattern).access(rule.rule)
PatternType.MVC -> requests.mvcMatchers(rule.httpMethod, rule.pattern) PatternType.MVC -> {
.apply { if (rule.servletPath != null) servletPath(rule.servletPath) } val introspector = requests.applicationContext.getBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME, HandlerMappingIntrospector::class.java)
.access(rule.rule) val mvcMatcher = MvcRequestMatcher.Builder(introspector)
.servletPath(rule.servletPath)
.pattern(rule.pattern)
mvcMatcher.setMethod(rule.httpMethod)
requests.requestMatchers(mvcMatcher).access(rule.rule)
}
} }
} }
} }

16
config/src/main/kotlin/org/springframework/security/config/annotation/web/AuthorizeRequestsDsl.kt
View File

@ -19,9 +19,11 @@ package org.springframework.security.config.annotation.web
import org.springframework.http.HttpMethod import org.springframework.http.HttpMethod
import org.springframework.security.config.annotation.web.builders.HttpSecurity import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer import org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher
import org.springframework.security.web.util.matcher.AnyRequestMatcher import org.springframework.security.web.util.matcher.AnyRequestMatcher
import org.springframework.security.web.util.matcher.RequestMatcher import org.springframework.security.web.util.matcher.RequestMatcher
import org.springframework.util.ClassUtils import org.springframework.util.ClassUtils
import org.springframework.web.servlet.handler.HandlerMappingIntrospector
/** /**
* A Kotlin DSL to configure [HttpSecurity] request authorization using idiomatic Kotlin code. * A Kotlin DSL to configure [HttpSecurity] request authorization using idiomatic Kotlin code.
@ -32,6 +34,7 @@ import org.springframework.util.ClassUtils
class AuthorizeRequestsDsl : AbstractRequestMatcherDsl() { class AuthorizeRequestsDsl : AbstractRequestMatcherDsl() {
private val authorizationRules = mutableListOf<AuthorizationRule>() private val authorizationRules = mutableListOf<AuthorizationRule>()
private val HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME = "mvcHandlerMappingIntrospector"
private val HANDLER_MAPPING_INTROSPECTOR = "org.springframework.web.servlet.handler.HandlerMappingIntrospector" private val HANDLER_MAPPING_INTROSPECTOR = "org.springframework.web.servlet.handler.HandlerMappingIntrospector"
private val MVC_PRESENT = ClassUtils.isPresent( private val MVC_PRESENT = ClassUtils.isPresent(
HANDLER_MAPPING_INTROSPECTOR, HANDLER_MAPPING_INTROSPECTOR,
@ -224,10 +227,15 @@ class AuthorizeRequestsDsl : AbstractRequestMatcherDsl() {
is MatcherAuthorizationRule -> requests.requestMatchers(rule.matcher).access(rule.rule) is MatcherAuthorizationRule -> requests.requestMatchers(rule.matcher).access(rule.rule)
is PatternAuthorizationRule -> { is PatternAuthorizationRule -> {
when (rule.patternType) { when (rule.patternType) {
PatternType.ANT -> requests.antMatchers(rule.httpMethod, rule.pattern).access(rule.rule) PatternType.ANT -> requests.requestMatchers(rule.httpMethod, rule.pattern).access(rule.rule)
PatternType.MVC -> requests.mvcMatchers(rule.httpMethod, rule.pattern) PatternType.MVC -> {
.apply { if(rule.servletPath != null) servletPath(rule.servletPath) } val introspector = requests.applicationContext.getBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME, HandlerMappingIntrospector::class.java)
.access(rule.rule) val mvcMatcher = MvcRequestMatcher.Builder(introspector)
.servletPath(rule.servletPath)
.pattern(rule.pattern)
mvcMatcher.setMethod(rule.httpMethod)
requests.requestMatchers(mvcMatcher).access(rule.rule)
}
} }
} }
} }

16
config/src/main/kotlin/org/springframework/security/config/annotation/web/CsrfDsl.kt
View File

@ -16,13 +16,13 @@
package org.springframework.security.config.annotation.web package org.springframework.security.config.annotation.web
import jakarta.servlet.http.HttpServletRequest
import org.springframework.security.config.annotation.web.builders.HttpSecurity import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer import org.springframework.security.config.annotation.web.configurers.CsrfConfigurer
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy
import org.springframework.security.web.csrf.CsrfTokenRepository import org.springframework.security.web.csrf.CsrfTokenRepository
import org.springframework.security.web.csrf.CsrfTokenRequestHandler import org.springframework.security.web.csrf.CsrfTokenRequestHandler
import org.springframework.security.web.util.matcher.RequestMatcher import org.springframework.security.web.util.matcher.RequestMatcher
import jakarta.servlet.http.HttpServletRequest
/** /**
* A Kotlin DSL to configure [HttpSecurity] CSRF protection * A Kotlin DSL to configure [HttpSecurity] CSRF protection
@ -42,23 +42,10 @@ class CsrfDsl {
var sessionAuthenticationStrategy: SessionAuthenticationStrategy? = null var sessionAuthenticationStrategy: SessionAuthenticationStrategy? = null
var csrfTokenRequestHandler: CsrfTokenRequestHandler? = null var csrfTokenRequestHandler: CsrfTokenRequestHandler? = null
private var ignoringAntMatchers: Array<out String>? = null
private var ignoringRequestMatchers: Array<out RequestMatcher>? = null private var ignoringRequestMatchers: Array<out RequestMatcher>? = null
private var ignoringRequestMatchersPatterns: Array<out String>? = null private var ignoringRequestMatchersPatterns: Array<out String>? = null
private var disabled = false private var disabled = false
/**
* Allows specifying [HttpServletRequest]s that should not use CSRF Protection
* even if they match the [requireCsrfProtectionMatcher].
*
* @param antMatchers the ANT pattern matchers that should not use CSRF
* protection
*/
@Deprecated("Use ignoringRequestMatchers instead")
fun ignoringAntMatchers(vararg antMatchers: String) {
ignoringAntMatchers = antMatchers
}
/** /**
* Allows specifying [HttpServletRequest]s that should not use CSRF Protection * Allows specifying [HttpServletRequest]s that should not use CSRF Protection
* even if they match the [requireCsrfProtectionMatcher]. * even if they match the [requireCsrfProtectionMatcher].
@ -93,7 +80,6 @@ class CsrfDsl {
requireCsrfProtectionMatcher?.also { csrf.requireCsrfProtectionMatcher(requireCsrfProtectionMatcher) } requireCsrfProtectionMatcher?.also { csrf.requireCsrfProtectionMatcher(requireCsrfProtectionMatcher) }
sessionAuthenticationStrategy?.also { csrf.sessionAuthenticationStrategy(sessionAuthenticationStrategy) } sessionAuthenticationStrategy?.also { csrf.sessionAuthenticationStrategy(sessionAuthenticationStrategy) }
csrfTokenRequestHandler?.also { csrf.csrfTokenRequestHandler(csrfTokenRequestHandler) } csrfTokenRequestHandler?.also { csrf.csrfTokenRequestHandler(csrfTokenRequestHandler) }
ignoringAntMatchers?.also { csrf.ignoringAntMatchers(*ignoringAntMatchers!!) }
ignoringRequestMatchers?.also { csrf.ignoringRequestMatchers(*ignoringRequestMatchers!!) } ignoringRequestMatchers?.also { csrf.ignoringRequestMatchers(*ignoringRequestMatchers!!) }
ignoringRequestMatchersPatterns?.also { csrf.ignoringRequestMatchers(*ignoringRequestMatchersPatterns!!) } ignoringRequestMatchersPatterns?.also { csrf.ignoringRequestMatchers(*ignoringRequestMatchersPatterns!!) }
if (disabled) { if (disabled) {

16
config/src/main/kotlin/org/springframework/security/config/annotation/web/HttpSecurityDsl.kt
View File

@ -137,18 +137,8 @@ class HttpSecurityDsl(private val http: HttpSecurity, private val init: HttpSecu
* configuration should be invoked. * configuration should be invoked.
*/ */
fun securityMatcher(vararg pattern: String) { fun securityMatcher(vararg pattern: String) {
val mvcPresent = ClassUtils.isPresent( this.http.securityMatchers {
HANDLER_MAPPING_INTROSPECTOR, it.requestMatchers(*pattern)
AuthorizeRequestsDsl::class.java.classLoader) ||
ClassUtils.isPresent(
HANDLER_MAPPING_INTROSPECTOR,
AuthorizeHttpRequestsDsl::class.java.classLoader)
this.http.requestMatchers {
if (mvcPresent) {
it.mvcMatchers(*pattern)
} else {
it.antMatchers(*pattern)
}
} }
} }
@ -180,7 +170,7 @@ class HttpSecurityDsl(private val http: HttpSecurity, private val init: HttpSecu
* this configuration should be invoked. * this configuration should be invoked.
*/ */
fun securityMatcher(vararg requestMatcher: RequestMatcher) { fun securityMatcher(vararg requestMatcher: RequestMatcher) {
this.http.requestMatchers { this.http.securityMatchers {
it.requestMatchers(*requestMatcher) it.requestMatchers(*requestMatcher)
} }
} }

14
config/src/main/kotlin/org/springframework/security/config/annotation/web/RequiresChannelDsl.kt
View File

@ -20,9 +20,11 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity
import org.springframework.security.config.annotation.web.configurers.ChannelSecurityConfigurer import org.springframework.security.config.annotation.web.configurers.ChannelSecurityConfigurer
import org.springframework.security.web.access.channel.ChannelDecisionManagerImpl import org.springframework.security.web.access.channel.ChannelDecisionManagerImpl
import org.springframework.security.web.access.channel.ChannelProcessor import org.springframework.security.web.access.channel.ChannelProcessor
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher
import org.springframework.security.web.util.matcher.AnyRequestMatcher import org.springframework.security.web.util.matcher.AnyRequestMatcher
import org.springframework.security.web.util.matcher.RequestMatcher import org.springframework.security.web.util.matcher.RequestMatcher
import org.springframework.util.ClassUtils import org.springframework.util.ClassUtils
import org.springframework.web.servlet.handler.HandlerMappingIntrospector
/** /**
* A Kotlin DSL to configure [HttpSecurity] channel security using idiomatic * A Kotlin DSL to configure [HttpSecurity] channel security using idiomatic
@ -36,6 +38,7 @@ import org.springframework.util.ClassUtils
class RequiresChannelDsl : AbstractRequestMatcherDsl() { class RequiresChannelDsl : AbstractRequestMatcherDsl() {
private val channelSecurityRules = mutableListOf<AuthorizationRule>() private val channelSecurityRules = mutableListOf<AuthorizationRule>()
private val HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME = "mvcHandlerMappingIntrospector"
private val HANDLER_MAPPING_INTROSPECTOR = "org.springframework.web.servlet.handler.HandlerMappingIntrospector" private val HANDLER_MAPPING_INTROSPECTOR = "org.springframework.web.servlet.handler.HandlerMappingIntrospector"
private val MVC_PRESENT = ClassUtils.isPresent( private val MVC_PRESENT = ClassUtils.isPresent(
HANDLER_MAPPING_INTROSPECTOR, HANDLER_MAPPING_INTROSPECTOR,
@ -119,11 +122,14 @@ class RequiresChannelDsl : AbstractRequestMatcherDsl() {
is MatcherAuthorizationRule -> channelSecurity.requestMatchers(rule.matcher).requires(rule.rule) is MatcherAuthorizationRule -> channelSecurity.requestMatchers(rule.matcher).requires(rule.rule)
is PatternAuthorizationRule -> { is PatternAuthorizationRule -> {
when (rule.patternType) { when (rule.patternType) {
PatternType.ANT -> channelSecurity.antMatchers(rule.pattern).requires(rule.rule) PatternType.ANT -> channelSecurity.requestMatchers(rule.pattern).requires(rule.rule)
PatternType.MVC -> { PatternType.MVC -> {
val mvcMatchersRequiresChannel = channelSecurity.mvcMatchers(rule.pattern) val introspector = channelSecurity.applicationContext.getBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME, HandlerMappingIntrospector::class.java)
rule.servletPath?.also { mvcMatchersRequiresChannel.servletPath(rule.servletPath) } val mvcMatcher = MvcRequestMatcher.Builder(introspector)
mvcMatchersRequiresChannel.requires(rule.rule) .servletPath(rule.servletPath)
.pattern(rule.pattern)
mvcMatcher.setMethod(rule.httpMethod)
channelSecurity.requestMatchers(mvcMatcher).requires(rule.rule)
} }
} }
} }

3
config/src/test/java/org/springframework/security/config/annotation/issue50/SecurityConfig.java
View File

@ -32,6 +32,7 @@ import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException; import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.userdetails.UsernameNotFoundException; import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.util.Assert; import org.springframework.util.Assert;
/** /**
@ -51,7 +52,7 @@ public class SecurityConfig {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/*").permitAll() .requestMatchers(new AntPathRequestMatcher("/*")).permitAll()
.and() .and()
.authenticationProvider(authenticationProvider()); .authenticationProvider(authenticationProvider());
// @formatter:on // @formatter:on

11
config/src/test/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistryAnyMatcherTests.java
View File

@ -25,8 +25,11 @@ import org.springframework.mock.web.MockServletContext;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher; import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.RegexRequestMatcher;
import org.springframework.web.context.support.AnnotationConfigWebApplicationContext; import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType; import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@ -85,7 +88,7 @@ public class AbstractRequestMatcherRegistryAnyMatcherTests {
http http
.authorizeRequests() .authorizeRequests()
.anyRequest().authenticated() .anyRequest().authenticated()
.antMatchers("/demo/**").permitAll(); .requestMatchers(new AntPathRequestMatcher("/demo/**")).permitAll();
return http.build(); return http.build();
// @formatter:on // @formatter:on
} }
@ -97,12 +100,12 @@ public class AbstractRequestMatcherRegistryAnyMatcherTests {
static class MvcMatchersAfterAnyRequestConfig { static class MvcMatchersAfterAnyRequestConfig {
@Bean @Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.anyRequest().authenticated() .anyRequest().authenticated()
.mvcMatchers("/demo/**").permitAll(); .requestMatchers(new MvcRequestMatcher(introspector, "/demo/**")).permitAll();
return http.build(); return http.build();
// @formatter:on // @formatter:on
} }
@ -119,7 +122,7 @@ public class AbstractRequestMatcherRegistryAnyMatcherTests {
http http
.authorizeRequests() .authorizeRequests()
.anyRequest().authenticated() .anyRequest().authenticated()
.regexMatchers(".*").permitAll(); .requestMatchers(new RegexRequestMatcher(".*", null)).permitAll();
return http.build(); return http.build();
// @formatter:on // @formatter:on
} }

10
config/src/test/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistryNoMvcTests.java
View File

@ -69,16 +69,6 @@ public class AbstractRequestMatcherRegistryNoMvcTests {
private static class TestRequestMatcherRegistry extends AbstractRequestMatcherRegistry<List<RequestMatcher>> { private static class TestRequestMatcherRegistry extends AbstractRequestMatcherRegistry<List<RequestMatcher>> {
@Override
public List<RequestMatcher> mvcMatchers(String... mvcPatterns) {
return null;
}
@Override
public List<RequestMatcher> mvcMatchers(HttpMethod method, String... mvcPatterns) {
return null;
}
@Override @Override
protected List<RequestMatcher> chainRequestMatchers(List<RequestMatcher> requestMatchers) { protected List<RequestMatcher> chainRequestMatchers(List<RequestMatcher> requestMatchers) {
return requestMatchers; return requestMatchers;

21
config/src/test/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistryTests.java
View File

@ -65,7 +65,8 @@ public class AbstractRequestMatcherRegistryTests {
@Test @Test
public void regexMatchersWhenHttpMethodAndPatternParamsThenReturnRegexRequestMatcherType() { public void regexMatchersWhenHttpMethodAndPatternParamsThenReturnRegexRequestMatcherType() {
List<RequestMatcher> requestMatchers = this.matcherRegistry.regexMatchers(HttpMethod.GET, "/a.*"); List<RequestMatcher> requestMatchers = this.matcherRegistry
.requestMatchers(new RegexRequestMatcher("/a.*", HttpMethod.GET.name()));
assertThat(requestMatchers).isNotEmpty(); assertThat(requestMatchers).isNotEmpty();
assertThat(requestMatchers.size()).isEqualTo(1); assertThat(requestMatchers.size()).isEqualTo(1);
assertThat(requestMatchers.get(0)).isExactlyInstanceOf(RegexRequestMatcher.class); assertThat(requestMatchers.get(0)).isExactlyInstanceOf(RegexRequestMatcher.class);
@ -73,7 +74,8 @@ public class AbstractRequestMatcherRegistryTests {
@Test @Test
public void regexMatchersWhenPatternParamThenReturnRegexRequestMatcherType() { public void regexMatchersWhenPatternParamThenReturnRegexRequestMatcherType() {
List<RequestMatcher> requestMatchers = this.matcherRegistry.regexMatchers("/a.*"); List<RequestMatcher> requestMatchers = this.matcherRegistry
.requestMatchers(new RegexRequestMatcher("/a.*", null));
assertThat(requestMatchers).isNotEmpty(); assertThat(requestMatchers).isNotEmpty();
assertThat(requestMatchers.size()).isEqualTo(1); assertThat(requestMatchers.size()).isEqualTo(1);
assertThat(requestMatchers.get(0)).isExactlyInstanceOf(RegexRequestMatcher.class); assertThat(requestMatchers.get(0)).isExactlyInstanceOf(RegexRequestMatcher.class);
@ -81,7 +83,8 @@ public class AbstractRequestMatcherRegistryTests {
@Test @Test
public void antMatchersWhenHttpMethodAndPatternParamsThenReturnAntPathRequestMatcherType() { public void antMatchersWhenHttpMethodAndPatternParamsThenReturnAntPathRequestMatcherType() {
List<RequestMatcher> requestMatchers = this.matcherRegistry.antMatchers(HttpMethod.GET, "/a.*"); List<RequestMatcher> requestMatchers = this.matcherRegistry
.requestMatchers(new AntPathRequestMatcher("/a.*", HttpMethod.GET.name()));
assertThat(requestMatchers).isNotEmpty(); assertThat(requestMatchers).isNotEmpty();
assertThat(requestMatchers.size()).isEqualTo(1); assertThat(requestMatchers.size()).isEqualTo(1);
assertThat(requestMatchers.get(0)).isExactlyInstanceOf(AntPathRequestMatcher.class); assertThat(requestMatchers.get(0)).isExactlyInstanceOf(AntPathRequestMatcher.class);
@ -89,7 +92,7 @@ public class AbstractRequestMatcherRegistryTests {
@Test @Test
public void antMatchersWhenPatternParamThenReturnAntPathRequestMatcherType() { public void antMatchersWhenPatternParamThenReturnAntPathRequestMatcherType() {
List<RequestMatcher> requestMatchers = this.matcherRegistry.antMatchers("/a.*"); List<RequestMatcher> requestMatchers = this.matcherRegistry.requestMatchers(new AntPathRequestMatcher("/a.*"));
assertThat(requestMatchers).isNotEmpty(); assertThat(requestMatchers).isNotEmpty();
assertThat(requestMatchers.size()).isEqualTo(1); assertThat(requestMatchers.size()).isEqualTo(1);
assertThat(requestMatchers.get(0)).isExactlyInstanceOf(AntPathRequestMatcher.class); assertThat(requestMatchers.get(0)).isExactlyInstanceOf(AntPathRequestMatcher.class);
@ -151,16 +154,6 @@ public class AbstractRequestMatcherRegistryTests {
private static class TestRequestMatcherRegistry extends AbstractRequestMatcherRegistry<List<RequestMatcher>> { private static class TestRequestMatcherRegistry extends AbstractRequestMatcherRegistry<List<RequestMatcher>> {
@Override
public List<RequestMatcher> mvcMatchers(String... mvcPatterns) {
return null;
}
@Override
public List<RequestMatcher> mvcMatchers(HttpMethod method, String... mvcPatterns) {
return null;
}
@Override @Override
protected List<RequestMatcher> chainRequestMatchers(List<RequestMatcher> requestMatchers) { protected List<RequestMatcher> chainRequestMatchers(List<RequestMatcher> requestMatchers) {
return requestMatchers; return requestMatchers;

11
config/src/test/java/org/springframework/security/config/annotation/web/builders/HttpConfigurationTests.java
View File

@ -36,8 +36,10 @@ import org.springframework.security.core.userdetails.PasswordEncodedUser;
import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager; import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.MockMvc;
import org.springframework.web.filter.OncePerRequestFilter; import org.springframework.web.filter.OncePerRequestFilter;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType; import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
@ -107,18 +109,19 @@ public class HttpConfigurationTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class RequestMatcherRegistryConfigs { static class RequestMatcherRegistryConfigs {
@Bean @Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
http http
.requestMatchers() .securityMatchers()
.antMatchers("/api/**") .requestMatchers(new AntPathRequestMatcher("/api/**"))
.antMatchers("/oauth/**") .requestMatchers(new AntPathRequestMatcher("/oauth/**"))
.and() .and()
.authorizeRequests() .authorizeRequests()
.antMatchers("/**").hasRole("USER") .anyRequest().hasRole("USER")
.and() .and()
.httpBasic(); .httpBasic();
return http.build(); return http.build();

26
config/src/test/java/org/springframework/security/config/annotation/web/builders/NamespaceHttpTests.java
View File

@ -62,6 +62,7 @@ import org.springframework.stereotype.Controller;
import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.MockMvc;
import org.springframework.test.web.servlet.MvcResult; import org.springframework.test.web.servlet.MvcResult;
import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThat;
import static org.mockito.ArgumentMatchers.any; import static org.mockito.ArgumentMatchers.any;
@ -302,6 +303,7 @@ public class NamespaceHttpTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class AccessDeniedPageConfig { static class AccessDeniedPageConfig {
@Bean @Bean
@ -309,7 +311,7 @@ public class NamespaceHttpTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/admin").hasRole("ADMIN") .requestMatchers("/admin").hasRole("ADMIN")
.anyRequest().authenticated() .anyRequest().authenticated()
.and() .and()
.exceptionHandling() .exceptionHandling()
@ -385,6 +387,7 @@ public class NamespaceHttpTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class IfRequiredConfig { static class IfRequiredConfig {
@Bean @Bean
@ -392,7 +395,7 @@ public class NamespaceHttpTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/unsecure").permitAll() .requestMatchers("/unsecure").permitAll()
.anyRequest().authenticated() .anyRequest().authenticated()
.and() .and()
.sessionManagement() .sessionManagement()
@ -487,7 +490,7 @@ public class NamespaceHttpTests {
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
http http
.antMatcher("/api/**"); .securityMatcher(new AntPathRequestMatcher("/api/**"));
return http.build(); return http.build();
// @formatter:on // @formatter:on
} }
@ -502,7 +505,7 @@ public class NamespaceHttpTests {
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
http http
.regexMatcher("/regex/.*"); .securityMatcher(new RegexRequestMatcher("/regex/.*", null));
return http.build(); return http.build();
// @formatter:on // @formatter:on
} }
@ -517,7 +520,7 @@ public class NamespaceHttpTests {
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
http http
.requestMatcher(new MyRequestMatcher()); .securityMatcher(new MyRequestMatcher());
return http.build(); return http.build();
// @formatter:on // @formatter:on
} }
@ -539,7 +542,8 @@ public class NamespaceHttpTests {
@Bean @Bean
WebSecurityCustomizer webSecurityCustomizer() { WebSecurityCustomizer webSecurityCustomizer() {
return (web) -> web.ignoring().antMatchers("/resources/**", "/public/**"); return (web) -> web.ignoring().requestMatchers(new AntPathRequestMatcher("/resources/**"),
new AntPathRequestMatcher("/public/**"));
} }
@Bean @Bean
@ -625,6 +629,7 @@ public class NamespaceHttpTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class UseExpressionsConfig { static class UseExpressionsConfig {
private Class<? extends FilterInvocationSecurityMetadataSource> filterInvocationSecurityMetadataSourceType; private Class<? extends FilterInvocationSecurityMetadataSource> filterInvocationSecurityMetadataSourceType;
@ -636,8 +641,8 @@ public class NamespaceHttpTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/users**", "/sessions/**").hasRole("USER") .requestMatchers("/users**", "/sessions/**").hasRole("USER")
.antMatchers("/signup").permitAll() .requestMatchers("/signup").permitAll()
.anyRequest().hasRole("USER"); .anyRequest().hasRole("USER");
this.httpSecurity = http; this.httpSecurity = http;
return http.build(); return http.build();
@ -659,6 +664,7 @@ public class NamespaceHttpTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class DisableUseExpressionsConfig { static class DisableUseExpressionsConfig {
private Class<? extends FilterInvocationSecurityMetadataSource> filterInvocationSecurityMetadataSourceType; private Class<? extends FilterInvocationSecurityMetadataSource> filterInvocationSecurityMetadataSourceType;
@ -670,8 +676,8 @@ public class NamespaceHttpTests {
// @formatter:off // @formatter:off
http http
.apply(new UrlAuthorizationConfigurer<>(context)).getRegistry() .apply(new UrlAuthorizationConfigurer<>(context)).getRegistry()
.antMatchers("/users**", "/sessions/**").hasRole("USER") .requestMatchers("/users**", "/sessions/**").hasRole("USER")
.antMatchers("/signup").hasRole("ANONYMOUS") .requestMatchers("/signup").hasRole("ANONYMOUS")
.anyRequest().hasRole("USER"); .anyRequest().hasRole("USER");
this.httpSecurity = http; this.httpSecurity = http;
return http.build(); return http.build();

11
config/src/test/java/org/springframework/security/config/annotation/web/builders/WebSecurityTests.java
View File

@ -40,12 +40,14 @@ import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.FilterChainProxy; import org.springframework.security.web.FilterChainProxy;
import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.firewall.HttpStatusRequestRejectedHandler; import org.springframework.security.web.firewall.HttpStatusRequestRejectedHandler;
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController; import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.context.support.AnnotationConfigWebApplicationContext; import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
import org.springframework.web.servlet.config.annotation.EnableWebMvc; import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import org.springframework.web.servlet.config.annotation.PathMatchConfigurer; import org.springframework.web.servlet.config.annotation.PathMatchConfigurer;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThat;
@ -147,8 +149,8 @@ public class WebSecurityTests {
static class MvcMatcherConfig { static class MvcMatcherConfig {
@Bean @Bean
WebSecurityCustomizer webSecurityCustomizer() { WebSecurityCustomizer webSecurityCustomizer(HandlerMappingIntrospector introspector) {
return (web) -> web.ignoring().mvcMatchers("/path"); return (web) -> web.ignoring().requestMatchers(new MvcRequestMatcher(introspector, "/path"));
} }
@Bean @Bean
@ -185,8 +187,9 @@ public class WebSecurityTests {
static class MvcMatcherServletPathConfig { static class MvcMatcherServletPathConfig {
@Bean @Bean
WebSecurityCustomizer webSecurityCustomizer() { WebSecurityCustomizer webSecurityCustomizer(HandlerMappingIntrospector introspector) {
return (web) -> web.ignoring().mvcMatchers("/path").servletPath("/spring").mvcMatchers("/notused"); MvcRequestMatcher.Builder builder = new MvcRequestMatcher.Builder(introspector).servletPath("/spring");
return (web) -> web.ignoring().requestMatchers(builder.pattern("/path")).requestMatchers("/notused");
} }
@Bean @Bean

38
config/src/test/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurationTests.java
View File

@ -58,10 +58,12 @@ import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.access.RequestMatcherDelegatingWebInvocationPrivilegeEvaluator; import org.springframework.security.web.access.RequestMatcherDelegatingWebInvocationPrivilegeEvaluator;
import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator; import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator;
import org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler; import org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.MockMvc;
import org.springframework.util.ClassUtils; import org.springframework.util.ClassUtils;
import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController; import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType; import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@ -346,7 +348,7 @@ public class WebSecurityConfigurationTests {
SecurityFilterChain filterChain1(HttpSecurity http) throws Exception { SecurityFilterChain filterChain1(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
return http return http
.antMatcher("/role1/**") .securityMatcher(new AntPathRequestMatcher("/role1/**"))
.authorizeRequests((authorize) -> authorize .authorizeRequests((authorize) -> authorize
.anyRequest().hasRole("1") .anyRequest().hasRole("1")
) )
@ -359,7 +361,7 @@ public class WebSecurityConfigurationTests {
SecurityFilterChain filterChain2(HttpSecurity http) throws Exception { SecurityFilterChain filterChain2(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
return http return http
.antMatcher("/role2/**") .securityMatcher(new AntPathRequestMatcher("/role2/**"))
.authorizeRequests((authorize) -> authorize .authorizeRequests((authorize) -> authorize
.anyRequest().hasRole("2") .anyRequest().hasRole("2")
) )
@ -372,7 +374,7 @@ public class WebSecurityConfigurationTests {
SecurityFilterChain filterChain3(HttpSecurity http) throws Exception { SecurityFilterChain filterChain3(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
return http return http
.antMatcher("/role3/**") .securityMatcher(new AntPathRequestMatcher("/role3/**"))
.authorizeRequests((authorize) -> authorize .authorizeRequests((authorize) -> authorize
.anyRequest().hasRole("3") .anyRequest().hasRole("3")
) )
@ -403,7 +405,7 @@ public class WebSecurityConfigurationTests {
SecurityFilterChain securityFilterChain1(HttpSecurity http) throws Exception { SecurityFilterChain securityFilterChain1(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
return http return http
.antMatcher("/role1/**") .securityMatcher(new AntPathRequestMatcher("/role1/**"))
.authorizeRequests((authorize) -> authorize .authorizeRequests((authorize) -> authorize
.anyRequest().hasRole("1") .anyRequest().hasRole("1")
) )
@ -634,31 +636,33 @@ public class WebSecurityConfigurationTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
@Import(AuthenticationTestConfiguration.class) @Import(AuthenticationTestConfiguration.class)
static class WebSecurityCustomizerConfig { static class WebSecurityCustomizerConfig {
@Bean @Bean
public WebSecurityCustomizer webSecurityCustomizer() { public WebSecurityCustomizer webSecurityCustomizer() {
return (web) -> web.ignoring().antMatchers("/ignore1", "/ignore2"); return (web) -> web.ignoring().requestMatchers("/ignore1", "/ignore2");
} }
} }
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
@Import(AuthenticationTestConfiguration.class) @Import(AuthenticationTestConfiguration.class)
static class CustomizerAndFilterChainConfig { static class CustomizerAndFilterChainConfig {
@Bean @Bean
public WebSecurityCustomizer webSecurityCustomizer() { public WebSecurityCustomizer webSecurityCustomizer() {
return (web) -> web.ignoring().antMatchers("/ignore1", "/ignore2"); return (web) -> web.ignoring().requestMatchers("/ignore1", "/ignore2");
} }
@Bean @Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
return http return http
.antMatcher("/role1/**") .securityMatcher(new AntPathRequestMatcher("/role1/**"))
.authorizeRequests((authorize) -> authorize .authorizeRequests((authorize) -> authorize
.anyRequest().hasRole("1") .anyRequest().hasRole("1")
) )
@ -670,19 +674,20 @@ public class WebSecurityConfigurationTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
@Import(AuthenticationTestConfiguration.class) @Import(AuthenticationTestConfiguration.class)
static class OrderedCustomizerConfig { static class OrderedCustomizerConfig {
@Order(1) @Order(1)
@Bean @Bean
public WebSecurityCustomizer webSecurityCustomizer1() { public WebSecurityCustomizer webSecurityCustomizer1() {
return (web) -> web.ignoring().antMatchers("/ignore1"); return (web) -> web.ignoring().requestMatchers("/ignore1");
} }
@Order(2) @Order(2)
@Bean @Bean
public WebSecurityCustomizer webSecurityCustomizer2() { public WebSecurityCustomizer webSecurityCustomizer2() {
return (web) -> web.ignoring().antMatchers("/ignore2"); return (web) -> web.ignoring().requestMatchers("/ignore2");
} }
} }
@ -696,7 +701,7 @@ public class WebSecurityConfigurationTests {
public SecurityFilterChain path1(HttpSecurity http) throws Exception { public SecurityFilterChain path1(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
http http
.requestMatchers((requests) -> requests.antMatchers("/path1/**")) .securityMatchers((requests) -> requests.requestMatchers(new AntPathRequestMatcher("/path1/**")))
.authorizeRequests((requests) -> requests.anyRequest().authenticated()); .authorizeRequests((requests) -> requests.anyRequest().authenticated());
// @formatter:on // @formatter:on
return http.build(); return http.build();
@ -720,7 +725,7 @@ public class WebSecurityConfigurationTests {
public SecurityFilterChain path1(HttpSecurity http) throws Exception { public SecurityFilterChain path1(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
http http
.requestMatchers((requests) -> requests.antMatchers("/path1/**")) .securityMatchers((requests) -> requests.requestMatchers(new AntPathRequestMatcher("/path1/**")))
.authorizeRequests((requests) -> requests.anyRequest().authenticated()); .authorizeRequests((requests) -> requests.anyRequest().authenticated());
// @formatter:on // @formatter:on
return http.build(); return http.build();
@ -745,7 +750,7 @@ public class WebSecurityConfigurationTests {
public SecurityFilterChain notAuthorized(HttpSecurity http) throws Exception { public SecurityFilterChain notAuthorized(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
http http
.requestMatchers((requests) -> requests.antMatchers("/user")) .securityMatchers((requests) -> requests.requestMatchers(new AntPathRequestMatcher("/user")))
.authorizeRequests((requests) -> requests.anyRequest().hasRole("USER")); .authorizeRequests((requests) -> requests.anyRequest().hasRole("USER"));
// @formatter:on // @formatter:on
return http.build(); return http.build();
@ -756,7 +761,7 @@ public class WebSecurityConfigurationTests {
public SecurityFilterChain path1(HttpSecurity http) throws Exception { public SecurityFilterChain path1(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
http http
.requestMatchers((requests) -> requests.antMatchers("/admin")) .securityMatchers((requests) -> requests.requestMatchers(new AntPathRequestMatcher("/admin")))
.authorizeRequests((requests) -> requests.anyRequest().hasRole("ADMIN")); .authorizeRequests((requests) -> requests.anyRequest().hasRole("ADMIN"));
// @formatter:on // @formatter:on
return http.build(); return http.build();
@ -773,12 +778,13 @@ public class WebSecurityConfigurationTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
@Import(AuthenticationTestConfiguration.class) @Import(AuthenticationTestConfiguration.class)
static class MultipleSecurityFilterChainIgnoringConfig { static class MultipleSecurityFilterChainIgnoringConfig {
@Bean @Bean
public WebSecurityCustomizer webSecurityCustomizer() { public WebSecurityCustomizer webSecurityCustomizer() {
return (web) -> web.ignoring().antMatchers("/ignoring1/**"); return (web) -> web.ignoring().requestMatchers("/ignoring1/**");
} }
@Bean @Bean
@ -786,7 +792,7 @@ public class WebSecurityConfigurationTests {
public SecurityFilterChain notAuthorized(HttpSecurity http) throws Exception { public SecurityFilterChain notAuthorized(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
http http
.requestMatchers((requests) -> requests.antMatchers("/user")) .securityMatchers((requests) -> requests.requestMatchers(new AntPathRequestMatcher("/user")))
.authorizeRequests((requests) -> requests.anyRequest().hasRole("USER")); .authorizeRequests((requests) -> requests.anyRequest().hasRole("USER"));
// @formatter:on // @formatter:on
return http.build(); return http.build();
@ -797,7 +803,7 @@ public class WebSecurityConfigurationTests {
public SecurityFilterChain admin(HttpSecurity http) throws Exception { public SecurityFilterChain admin(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
http http
.requestMatchers((requests) -> requests.antMatchers("/admin")) .securityMatchers((requests) -> requests.requestMatchers(new AntPathRequestMatcher("/admin")))
.authorizeRequests((requests) -> requests.anyRequest().hasRole("ADMIN")); .authorizeRequests((requests) -> requests.anyRequest().hasRole("ADMIN"));
// @formatter:on // @formatter:on
return http.build(); return http.build();

25
config/src/test/java/org/springframework/security/config/annotation/web/configurers/AbstractConfigAttributeRequestMatcherRegistryTests.java
View File

@ -22,7 +22,6 @@ import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test; import org.junit.jupiter.api.Test;
import org.springframework.http.HttpMethod; import org.springframework.http.HttpMethod;
import org.springframework.security.access.AccessDecisionVoter;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher; import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.RegexRequestMatcher; import org.springframework.security.web.util.matcher.RegexRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher; import org.springframework.security.web.util.matcher.RequestMatcher;
@ -40,7 +39,8 @@ public class AbstractConfigAttributeRequestMatcherRegistryTests {
@Test @Test
public void testGetRequestMatcherIsTypeRegexMatcher() { public void testGetRequestMatcherIsTypeRegexMatcher() {
List<RequestMatcher> requestMatchers = this.registry.regexMatchers(HttpMethod.GET, "/a.*"); List<RequestMatcher> requestMatchers = this.registry
.requestMatchers(new RegexRequestMatcher("/a.*", HttpMethod.GET.name()));
for (RequestMatcher requestMatcher : requestMatchers) { for (RequestMatcher requestMatcher : requestMatchers) {
assertThat(requestMatcher).isInstanceOf(RegexRequestMatcher.class); assertThat(requestMatcher).isInstanceOf(RegexRequestMatcher.class);
} }
@ -48,7 +48,7 @@ public class AbstractConfigAttributeRequestMatcherRegistryTests {
@Test @Test
public void testRequestMatcherIsTypeRegexMatcher() { public void testRequestMatcherIsTypeRegexMatcher() {
List<RequestMatcher> requestMatchers = this.registry.regexMatchers("/a.*"); List<RequestMatcher> requestMatchers = this.registry.requestMatchers(new RegexRequestMatcher("/a.*", null));
for (RequestMatcher requestMatcher : requestMatchers) { for (RequestMatcher requestMatcher : requestMatchers) {
assertThat(requestMatcher).isInstanceOf(RegexRequestMatcher.class); assertThat(requestMatcher).isInstanceOf(RegexRequestMatcher.class);
} }
@ -56,7 +56,8 @@ public class AbstractConfigAttributeRequestMatcherRegistryTests {
@Test @Test
public void testGetRequestMatcherIsTypeAntPathRequestMatcher() { public void testGetRequestMatcherIsTypeAntPathRequestMatcher() {
List<RequestMatcher> requestMatchers = this.registry.antMatchers(HttpMethod.GET, "/a.*"); List<RequestMatcher> requestMatchers = this.registry
.requestMatchers(new AntPathRequestMatcher("/a.*", HttpMethod.GET.name()));
for (RequestMatcher requestMatcher : requestMatchers) { for (RequestMatcher requestMatcher : requestMatchers) {
assertThat(requestMatcher).isInstanceOf(AntPathRequestMatcher.class); assertThat(requestMatcher).isInstanceOf(AntPathRequestMatcher.class);
} }
@ -64,7 +65,7 @@ public class AbstractConfigAttributeRequestMatcherRegistryTests {
@Test @Test
public void testRequestMatcherIsTypeAntPathRequestMatcher() { public void testRequestMatcherIsTypeAntPathRequestMatcher() {
List<RequestMatcher> requestMatchers = this.registry.antMatchers("/a.*"); List<RequestMatcher> requestMatchers = this.registry.requestMatchers(new AntPathRequestMatcher("/a.*"));
for (RequestMatcher requestMatcher : requestMatchers) { for (RequestMatcher requestMatcher : requestMatchers) {
assertThat(requestMatcher).isInstanceOf(AntPathRequestMatcher.class); assertThat(requestMatcher).isInstanceOf(AntPathRequestMatcher.class);
} }
@ -73,25 +74,11 @@ public class AbstractConfigAttributeRequestMatcherRegistryTests {
static class ConcreteAbstractRequestMatcherMappingConfigurer static class ConcreteAbstractRequestMatcherMappingConfigurer
extends AbstractConfigAttributeRequestMatcherRegistry<List<RequestMatcher>> { extends AbstractConfigAttributeRequestMatcherRegistry<List<RequestMatcher>> {
List<AccessDecisionVoter> decisionVoters() {
return null;
}
@Override @Override
protected List<RequestMatcher> chainRequestMatchersInternal(List<RequestMatcher> requestMatchers) { protected List<RequestMatcher> chainRequestMatchersInternal(List<RequestMatcher> requestMatchers) {
return requestMatchers; return requestMatchers;
} }
@Override
public List<RequestMatcher> mvcMatchers(String... mvcPatterns) {
return null;
}
@Override
public List<RequestMatcher> mvcMatchers(HttpMethod method, String... mvcPatterns) {
return null;
}
} }
} }

12
config/src/test/java/org/springframework/security/config/annotation/web/configurers/AuthorizeHttpRequestsConfigurerTests.java
View File

@ -46,6 +46,7 @@ import org.springframework.security.web.access.expression.WebExpressionAuthoriza
import org.springframework.security.web.access.intercept.AuthorizationFilter; import org.springframework.security.web.access.intercept.AuthorizationFilter;
import org.springframework.security.web.access.intercept.RequestAuthorizationContext; import org.springframework.security.web.access.intercept.RequestAuthorizationContext;
import org.springframework.security.web.access.intercept.RequestMatcherDelegatingAuthorizationManager; import org.springframework.security.web.access.intercept.RequestMatcherDelegatingAuthorizationManager;
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.MockMvc;
import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder; import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
import org.springframework.test.web.servlet.request.RequestPostProcessor; import org.springframework.test.web.servlet.request.RequestPostProcessor;
@ -55,6 +56,7 @@ import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController; import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.servlet.config.annotation.EnableWebMvc; import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType; import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
import static org.mockito.Mockito.any; import static org.mockito.Mockito.any;
@ -615,7 +617,7 @@ public class AuthorizeHttpRequestsConfigurerTests {
return http return http
.authorizeHttpRequests((requests) -> requests .authorizeHttpRequests((requests) -> requests
.anyRequest().authenticated() .anyRequest().authenticated()
.mvcMatchers("/path").hasRole("USER") .requestMatchers("/path").hasRole("USER")
) )
.build(); .build();
// @formatter:on // @formatter:on
@ -847,11 +849,13 @@ public class AuthorizeHttpRequestsConfigurerTests {
static class ServletPathConfig { static class ServletPathConfig {
@Bean @Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception {
MvcRequestMatcher.Builder mvcMatcherBuilder = new MvcRequestMatcher.Builder(introspector)
.servletPath("/spring");
// @formatter:off // @formatter:off
return http return http
.authorizeHttpRequests((requests) -> requests .authorizeHttpRequests((requests) -> requests
.mvcMatchers("/").servletPath("/spring").hasRole("ADMIN") .requestMatchers(mvcMatcherBuilder.pattern("/")).hasRole("ADMIN")
) )
.build(); .build();
// @formatter:on // @formatter:on
@ -940,7 +944,7 @@ public class AuthorizeHttpRequestsConfigurerTests {
http http
.httpBasic(withDefaults()) .httpBasic(withDefaults())
.authorizeHttpRequests((requests) -> requests .authorizeHttpRequests((requests) -> requests
.mvcMatchers("/user/{username}").access(new WebExpressionAuthorizationManager("#username == 'user'")) .requestMatchers("/user/{username}").access(new WebExpressionAuthorizationManager("#username == 'user'"))
); );
// @formatter:on // @formatter:on
return http.build(); return http.build();

28
config/src/test/java/org/springframework/security/config/annotation/web/configurers/AuthorizeRequestsTests.java
View File

@ -42,6 +42,7 @@ import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.FilterChainProxy; import org.springframework.security.web.FilterChainProxy;
import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.context.HttpSessionSecurityContextRepository; import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher; import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController; import org.springframework.web.bind.annotation.RestController;
@ -49,6 +50,7 @@ import org.springframework.web.context.support.AnnotationConfigWebApplicationCon
import org.springframework.web.servlet.config.annotation.EnableWebMvc; import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import org.springframework.web.servlet.config.annotation.PathMatchConfigurer; import org.springframework.web.servlet.config.annotation.PathMatchConfigurer;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThat;
import static org.mockito.Mockito.spy; import static org.mockito.Mockito.spy;
@ -289,7 +291,7 @@ public class AuthorizeRequestsTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers(HttpMethod.POST).denyAll(); .requestMatchers(new AntPathRequestMatcher("/**", HttpMethod.POST.name())).denyAll();
// @formatter:on // @formatter:on
return http.build(); return http.build();
} }
@ -311,7 +313,7 @@ public class AuthorizeRequestsTests {
http http
.authorizeRequests((authorizeRequests) -> .authorizeRequests((authorizeRequests) ->
authorizeRequests authorizeRequests
.antMatchers(HttpMethod.POST).denyAll() .requestMatchers(new AntPathRequestMatcher("/**", HttpMethod.POST.name())).denyAll()
); );
// @formatter:on // @formatter:on
return http.build(); return http.build();
@ -407,7 +409,7 @@ public class AuthorizeRequestsTests {
http http
.httpBasic().and() .httpBasic().and()
.authorizeRequests() .authorizeRequests()
.mvcMatchers("/path").denyAll(); .requestMatchers("/path").denyAll();
// @formatter:on // @formatter:on
return http.build(); return http.build();
} }
@ -441,7 +443,7 @@ public class AuthorizeRequestsTests {
.httpBasic(withDefaults()) .httpBasic(withDefaults())
.authorizeRequests((authorizeRequests) -> .authorizeRequests((authorizeRequests) ->
authorizeRequests authorizeRequests
.mvcMatchers("/path").denyAll() .requestMatchers("/path").denyAll()
); );
// @formatter:on // @formatter:on
return http.build(); return http.build();
@ -470,12 +472,14 @@ public class AuthorizeRequestsTests {
static class MvcMatcherServletPathConfig { static class MvcMatcherServletPathConfig {
@Bean @Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception {
MvcRequestMatcher.Builder mvcMatcherBuilder = new MvcRequestMatcher.Builder(introspector)
.servletPath("/spring");
// @formatter:off // @formatter:off
http http
.httpBasic().and() .httpBasic().and()
.authorizeRequests() .authorizeRequests()
.mvcMatchers("/path").servletPath("/spring").denyAll(); .requestMatchers(mvcMatcherBuilder.pattern("/path")).denyAll();
// @formatter:on // @formatter:on
return http.build(); return http.build();
} }
@ -503,13 +507,15 @@ public class AuthorizeRequestsTests {
static class MvcMatcherServletPathInLambdaConfig { static class MvcMatcherServletPathInLambdaConfig {
@Bean @Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception {
MvcRequestMatcher.Builder mvcMatcherBuilder = new MvcRequestMatcher.Builder(introspector)
.servletPath("/spring");
// @formatter:off // @formatter:off
http http
.httpBasic(withDefaults()) .httpBasic(withDefaults())
.authorizeRequests((authorizeRequests) -> .authorizeRequests((authorizeRequests) ->
authorizeRequests authorizeRequests
.mvcMatchers("/path").servletPath("/spring").denyAll() .requestMatchers(mvcMatcherBuilder.pattern("/path")).denyAll()
); );
// @formatter:on // @formatter:on
return http.build(); return http.build();
@ -543,7 +549,7 @@ public class AuthorizeRequestsTests {
http http
.httpBasic().and() .httpBasic().and()
.authorizeRequests() .authorizeRequests()
.mvcMatchers("/user/{userName}").access("#userName == 'user'"); .requestMatchers("/user/{userName}").access("#userName == 'user'");
// @formatter:on // @formatter:on
return http.build(); return http.build();
} }
@ -577,7 +583,7 @@ public class AuthorizeRequestsTests {
.httpBasic(withDefaults()) .httpBasic(withDefaults())
.authorizeRequests((authorizeRequests) -> .authorizeRequests((authorizeRequests) ->
authorizeRequests authorizeRequests
.mvcMatchers("/user/{userName}").access("#userName == 'user'") .requestMatchers("/user/{userName}").access("#userName == 'user'")
); );
// @formatter:on // @formatter:on
return http.build(); return http.build();
@ -611,7 +617,7 @@ public class AuthorizeRequestsTests {
http http
.httpBasic().and() .httpBasic().and()
.authorizeRequests() .authorizeRequests()
.mvcMatchers("/user").denyAll(); .requestMatchers("/user").denyAll();
// @formatter:on // @formatter:on
return http.build(); return http.build();
} }

12
config/src/test/java/org/springframework/security/config/annotation/web/configurers/ChannelSecurityConfigurerTests.java
View File

@ -243,11 +243,11 @@ public class ChannelSecurityConfigurerTests {
.portMapper(new PortMapperImpl()) .portMapper(new PortMapperImpl())
.and() .and()
.requiresChannel() .requiresChannel()
.mvcMatchers("/test-1") .requestMatchers("/test-1")
.requiresSecure() .requiresSecure()
.mvcMatchers("/test-2") .requestMatchers("/test-2")
.requiresSecure() .requiresSecure()
.mvcMatchers("/test-3") .requestMatchers("/test-3")
.requiresSecure() .requiresSecure()
.anyRequest() .anyRequest()
.requiresInsecure(); .requiresInsecure();
@ -271,11 +271,11 @@ public class ChannelSecurityConfigurerTests {
.portMapper(new PortMapperImpl()) .portMapper(new PortMapperImpl())
) )
.requiresChannel((channel) -> channel .requiresChannel((channel) -> channel
.mvcMatchers("/test-1") .requestMatchers("/test-1")
.requiresSecure() .requiresSecure()
.mvcMatchers("/test-2") .requestMatchers("/test-2")
.requiresSecure() .requiresSecure()
.mvcMatchers("/test-3") .requestMatchers("/test-3")
.requiresSecure() .requiresSecure()
.anyRequest() .anyRequest()
.requiresInsecure() .requiresInsecure()

6
config/src/test/java/org/springframework/security/config/annotation/web/configurers/CsrfConfigurerIgnoringRequestMatchersTests.java
View File

@ -119,6 +119,7 @@ public class CsrfConfigurerIgnoringRequestMatchersTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class IgnoringRequestInLambdaMatchers { static class IgnoringRequestInLambdaMatchers {
RequestMatcher requestMatcher = (request) -> HttpMethod.POST.name().equals(request.getMethod()); RequestMatcher requestMatcher = (request) -> HttpMethod.POST.name().equals(request.getMethod());
@ -149,7 +150,7 @@ public class CsrfConfigurerIgnoringRequestMatchersTests {
// @formatter:off // @formatter:off
http http
.csrf() .csrf()
.ignoringAntMatchers("/no-csrf") .ignoringRequestMatchers(new AntPathRequestMatcher("/no-csrf"))
.ignoringRequestMatchers(this.requestMatcher); .ignoringRequestMatchers(this.requestMatcher);
return http.build(); return http.build();
// @formatter:on // @formatter:on
@ -159,6 +160,7 @@ public class CsrfConfigurerIgnoringRequestMatchersTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class IgnoringPathsAndMatchersInLambdaConfig { static class IgnoringPathsAndMatchersInLambdaConfig {
RequestMatcher requestMatcher = (request) -> HttpMethod.POST.name().equals(request.getMethod()); RequestMatcher requestMatcher = (request) -> HttpMethod.POST.name().equals(request.getMethod());
@ -169,7 +171,7 @@ public class CsrfConfigurerIgnoringRequestMatchersTests {
http http
.csrf((csrf) -> .csrf((csrf) ->
csrf csrf
.ignoringAntMatchers("/no-csrf") .ignoringRequestMatchers(new AntPathRequestMatcher("/no-csrf"))
.ignoringRequestMatchers(this.requestMatcher) .ignoringRequestMatchers(this.requestMatcher)
); );
return http.build(); return http.build();

4
config/src/test/java/org/springframework/security/config/annotation/web/configurers/DefaultFiltersTests.java
View File

@ -57,6 +57,7 @@ import org.springframework.security.web.header.HeaderWriterFilter;
import org.springframework.security.web.savedrequest.RequestCacheAwareFilter; import org.springframework.security.web.savedrequest.RequestCacheAwareFilter;
import org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter; import org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter;
import org.springframework.security.web.util.matcher.AnyRequestMatcher; import org.springframework.security.web.util.matcher.AnyRequestMatcher;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThat;
@ -163,11 +164,12 @@ public class DefaultFiltersTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class FilterChainProxyBuilderIgnoringConfig { static class FilterChainProxyBuilderIgnoringConfig {
@Bean @Bean
WebSecurityCustomizer webSecurityCustomizer() { WebSecurityCustomizer webSecurityCustomizer() {
return (web) -> web.ignoring().antMatchers("/resources/**"); return (web) -> web.ignoring().requestMatchers("/resources/**");
} }
@Bean @Bean

35
config/src/test/java/org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationConfigurerTests.java
View File

@ -63,6 +63,7 @@ import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable; import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RestController; import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType; import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@ -611,6 +612,7 @@ public class ExpressionUrlAuthorizationConfigurerTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class IncompleteMappingConfig { static class IncompleteMappingConfig {
@Bean @Bean
@ -618,7 +620,7 @@ public class ExpressionUrlAuthorizationConfigurerTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/a").authenticated() .requestMatchers("/a").authenticated()
.anyRequest(); .anyRequest();
return http.build(); return http.build();
// @formatter:on // @formatter:on
@ -965,6 +967,7 @@ public class ExpressionUrlAuthorizationConfigurerTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class AllPropertiesWorkConfig { static class AllPropertiesWorkConfig {
@Bean @Bean
@ -978,7 +981,7 @@ public class ExpressionUrlAuthorizationConfigurerTests {
.expressionHandler(handler) .expressionHandler(handler)
.accessDecisionManager(adm) .accessDecisionManager(adm)
.filterSecurityInterceptorOncePerRequest(true) .filterSecurityInterceptorOncePerRequest(true)
.antMatchers("/a", "/b").hasRole("ADMIN") .requestMatchers("/a", "/b").hasRole("ADMIN")
.anyRequest().permitAll() .anyRequest().permitAll()
.and() .and()
.formLogin(); .formLogin();
@ -1034,6 +1037,7 @@ public class ExpressionUrlAuthorizationConfigurerTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class UseBeansInExpressions { static class UseBeansInExpressions {
@Bean @Bean
@ -1041,9 +1045,9 @@ public class ExpressionUrlAuthorizationConfigurerTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/admin").hasRole("ADMIN") .requestMatchers("/admin").hasRole("ADMIN")
.antMatchers("/user").hasRole("USER") .requestMatchers("/user").hasRole("USER")
.antMatchers("/allow").access("@permission.check(authentication,'user')") .requestMatchers("/allow").access("@permission.check(authentication,'user')")
.anyRequest().access("@permission.check(authentication,'admin')"); .anyRequest().access("@permission.check(authentication,'admin')");
return http.build(); return http.build();
// @formatter:on // @formatter:on
@ -1066,6 +1070,7 @@ public class ExpressionUrlAuthorizationConfigurerTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class CustomExpressionRootConfig { static class CustomExpressionRootConfig {
@Bean @Bean
@ -1074,9 +1079,9 @@ public class ExpressionUrlAuthorizationConfigurerTests {
http http
.authorizeRequests() .authorizeRequests()
.expressionHandler(expressionHandler()) .expressionHandler(expressionHandler())
.antMatchers("/admin").hasRole("ADMIN") .requestMatchers("/admin").hasRole("ADMIN")
.antMatchers("/user").hasRole("USER") .requestMatchers("/user").hasRole("USER")
.antMatchers("/allow").access("check('user')") .requestMatchers("/allow").access("check('user')")
.anyRequest().access("check('admin')"); .anyRequest().access("check('admin')");
return http.build(); return http.build();
// @formatter:on // @formatter:on
@ -1146,6 +1151,7 @@ public class ExpressionUrlAuthorizationConfigurerTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class PermissionEvaluatorConfig { static class PermissionEvaluatorConfig {
@Bean @Bean
@ -1153,10 +1159,10 @@ public class ExpressionUrlAuthorizationConfigurerTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/allow").access("hasPermission('ID', 'TYPE', 'PERMISSION')") .requestMatchers("/allow").access("hasPermission('ID', 'TYPE', 'PERMISSION')")
.antMatchers("/allowObject").access("hasPermission('TESTOBJ', 'PERMISSION')") .requestMatchers("/allowObject").access("hasPermission('TESTOBJ', 'PERMISSION')")
.antMatchers("/deny").access("hasPermission('ID', 'TYPE', 'NO PERMISSION')") .requestMatchers("/deny").access("hasPermission('ID', 'TYPE', 'NO PERMISSION')")
.antMatchers("/denyObject").access("hasPermission('TESTOBJ', 'NO PERMISSION')") .requestMatchers("/denyObject").access("hasPermission('TESTOBJ', 'NO PERMISSION')")
.anyRequest().permitAll(); .anyRequest().permitAll();
return http.build(); return http.build();
// @formatter:on // @formatter:on
@ -1183,6 +1189,7 @@ public class ExpressionUrlAuthorizationConfigurerTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class RoleHierarchyConfig { static class RoleHierarchyConfig {
@Bean @Bean
@ -1190,8 +1197,8 @@ public class ExpressionUrlAuthorizationConfigurerTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/allow").access("hasRole('MEMBER')") .requestMatchers("/allow").access("hasRole('MEMBER')")
.antMatchers("/deny").access("hasRole('ADMIN')") .requestMatchers("/deny").access("hasRole('ADMIN')")
.anyRequest().permitAll(); .anyRequest().permitAll();
return http.build(); return http.build();
// @formatter:on // @formatter:on

4
config/src/test/java/org/springframework/security/config/annotation/web/configurers/FormLoginConfigurerTests.java
View File

@ -45,6 +45,7 @@ import org.springframework.security.web.authentication.LoginUrlAuthenticationEnt
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.savedrequest.RequestCache; import org.springframework.security.web.savedrequest.RequestCache;
import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.MockMvc;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import static org.mockito.ArgumentMatchers.any; import static org.mockito.ArgumentMatchers.any;
import static org.mockito.BDDMockito.given; import static org.mockito.BDDMockito.given;
@ -409,11 +410,12 @@ public class FormLoginConfigurerTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class FormLoginConfig { static class FormLoginConfig {
@Bean @Bean
WebSecurityCustomizer webSecurityCustomizer() { WebSecurityCustomizer webSecurityCustomizer() {
return (web) -> web.ignoring().antMatchers("/resources/**"); return (web) -> web.ignoring().requestMatchers("/resources/**");
} }
@Bean @Bean

146
config/src/test/java/org/springframework/security/config/annotation/web/configurers/HttpSecurityAntMatchersTests.java
View File

@ -1,146 +0,0 @@
/*
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.config.annotation.web.configurers;
import jakarta.servlet.http.HttpServletResponse;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.mock.web.MockFilterChain;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.FilterChainProxy;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
import static org.assertj.core.api.Assertions.assertThat;
/**
* @author Rob Winch
*
*/
public class HttpSecurityAntMatchersTests {
AnnotationConfigWebApplicationContext context;
MockHttpServletRequest request;
MockHttpServletResponse response;
MockFilterChain chain;
@Autowired
FilterChainProxy springSecurityFilterChain;
@BeforeEach
public void setup() {
this.request = new MockHttpServletRequest("GET", "");
this.response = new MockHttpServletResponse();
this.chain = new MockFilterChain();
}
@AfterEach
public void cleanup() {
if (this.context != null) {
this.context.close();
}
}
// SEC-3135
@Test
public void antMatchersMethodAndNoPatterns() throws Exception {
loadConfig(AntMatchersNoPatternsConfig.class);
this.request.setMethod("POST");
this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_FORBIDDEN);
}
// SEC-3135
@Test
public void antMatchersMethodAndEmptyPatterns() throws Exception {
loadConfig(AntMatchersEmptyPatternsConfig.class);
this.request.setMethod("POST");
this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
assertThat(this.response.getStatus()).isEqualTo(HttpServletResponse.SC_OK);
}
public void loadConfig(Class<?>... configs) {
this.context = new AnnotationConfigWebApplicationContext();
this.context.register(configs);
this.context.refresh();
this.context.getAutowireCapableBeanFactory().autowireBean(this);
}
@EnableWebSecurity
@Configuration
static class AntMatchersNoPatternsConfig {
@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// @formatter:off
http
.requestMatchers()
.antMatchers(HttpMethod.POST)
.and()
.authorizeRequests()
.anyRequest().denyAll();
// @formatter:on
return http.build();
}
@Bean
UserDetailsService userDetailsService() {
return new InMemoryUserDetailsManager();
}
}
@EnableWebSecurity
@Configuration
static class AntMatchersEmptyPatternsConfig {
@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// @formatter:off
http
.requestMatchers()
.antMatchers("/never/")
.antMatchers(HttpMethod.POST, new String[0])
.and()
.authorizeRequests()
.anyRequest().denyAll();
// @formatter:on
return http.build();
}
@Bean
UserDetailsService userDetailsService() {
return new InMemoryUserDetailsManager();
}
}
}

78
config/src/test/java/org/springframework/security/config/annotation/web/configurers/HttpSecurityRequestMatchersTests.java
View File

@ -36,12 +36,14 @@ import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager; import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.FilterChainProxy; import org.springframework.security.web.FilterChainProxy;
import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController; import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.context.support.AnnotationConfigWebApplicationContext; import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
import org.springframework.web.servlet.config.annotation.EnableWebMvc; import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import org.springframework.web.servlet.config.annotation.PathMatchConfigurer; import org.springframework.web.servlet.config.annotation.PathMatchConfigurer;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThat;
import static org.springframework.security.config.Customizer.withDefaults; import static org.springframework.security.config.Customizer.withDefaults;
@ -217,13 +219,14 @@ public class HttpSecurityRequestMatchersTests {
@Bean @Bean
@Order(Ordered.HIGHEST_PRECEDENCE) @Order(Ordered.HIGHEST_PRECEDENCE)
SecurityFilterChain first(HttpSecurity http) throws Exception { SecurityFilterChain first(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception {
MvcRequestMatcher.Builder mvcMatcherBuilder = new MvcRequestMatcher.Builder(introspector);
// @formatter:off // @formatter:off
http http
.requestMatchers((requests) -> requests .securityMatchers((requests) -> requests
.mvcMatchers("/test-1") .requestMatchers(mvcMatcherBuilder.pattern("/test-1"))
.mvcMatchers("/test-2") .requestMatchers(mvcMatcherBuilder.pattern("/test-2"))
.mvcMatchers("/test-3") .requestMatchers(mvcMatcherBuilder.pattern("/test-3"))
) )
.authorizeRequests((authorize) -> authorize.anyRequest().denyAll()) .authorizeRequests((authorize) -> authorize.anyRequest().denyAll())
.httpBasic(withDefaults()); .httpBasic(withDefaults());
@ -232,11 +235,12 @@ public class HttpSecurityRequestMatchersTests {
} }
@Bean @Bean
SecurityFilterChain second(HttpSecurity http) throws Exception { SecurityFilterChain second(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception {
MvcRequestMatcher.Builder mvcMatcherBuilder = new MvcRequestMatcher.Builder(introspector);
// @formatter:off // @formatter:off
http http
.requestMatchers((requests) -> requests .securityMatchers((requests) -> requests
.mvcMatchers("/test-1") .requestMatchers(mvcMatcherBuilder.pattern("/test-1"))
) )
.authorizeRequests((authorize) -> authorize .authorizeRequests((authorize) -> authorize
.anyRequest().permitAll() .anyRequest().permitAll()
@ -264,13 +268,14 @@ public class HttpSecurityRequestMatchersTests {
@Bean @Bean
@Order(Ordered.HIGHEST_PRECEDENCE) @Order(Ordered.HIGHEST_PRECEDENCE)
SecurityFilterChain first(HttpSecurity http) throws Exception { SecurityFilterChain first(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception {
MvcRequestMatcher.Builder mvcMatcherBuilder = new MvcRequestMatcher.Builder(introspector);
// @formatter:off // @formatter:off
http http
.requestMatchers() .securityMatchers()
.mvcMatchers("/test-1") .requestMatchers(mvcMatcherBuilder.pattern("/test-1"))
.mvcMatchers("/test-2") .requestMatchers(mvcMatcherBuilder.pattern("/test-2"))
.mvcMatchers("/test-3") .requestMatchers(mvcMatcherBuilder.pattern("/test-3"))
.and() .and()
.authorizeRequests() .authorizeRequests()
.anyRequest().denyAll() .anyRequest().denyAll()
@ -281,11 +286,12 @@ public class HttpSecurityRequestMatchersTests {
} }
@Bean @Bean
SecurityFilterChain second(HttpSecurity http) throws Exception { SecurityFilterChain second(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception {
MvcRequestMatcher.Builder mvcMatcherBuilder = new MvcRequestMatcher.Builder(introspector);
// @formatter:off // @formatter:off
http http
.requestMatchers() .securityMatchers()
.mvcMatchers("/test-1") .requestMatchers(mvcMatcherBuilder.pattern("/test-1"))
.and() .and()
.authorizeRequests() .authorizeRequests()
.anyRequest().permitAll(); .anyRequest().permitAll();
@ -311,10 +317,10 @@ public class HttpSecurityRequestMatchersTests {
static class MvcMatcherConfig { static class MvcMatcherConfig {
@Bean @Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception {
// @formatter:off // @formatter:off
http http
.mvcMatcher("/path") .securityMatcher(new MvcRequestMatcher(introspector, "/path"))
.httpBasic().and() .httpBasic().and()
.authorizeRequests() .authorizeRequests()
.anyRequest().denyAll(); .anyRequest().denyAll();
@ -345,11 +351,11 @@ public class HttpSecurityRequestMatchersTests {
static class RequestMatchersMvcMatcherConfig { static class RequestMatchersMvcMatcherConfig {
@Bean @Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception {
// @formatter:off // @formatter:off
http http
.requestMatchers() .securityMatchers()
.mvcMatchers("/path") .requestMatchers(new MvcRequestMatcher(introspector, "/path"))
.and() .and()
.httpBasic().and() .httpBasic().and()
.authorizeRequests() .authorizeRequests()
@ -381,12 +387,12 @@ public class HttpSecurityRequestMatchersTests {
static class RequestMatchersMvcMatcherInLambdaConfig { static class RequestMatchersMvcMatcherInLambdaConfig {
@Bean @Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception {
// @formatter:off // @formatter:off
http http
.requestMatchers((requestMatchers) -> .securityMatchers((matchers) ->
requestMatchers matchers
.mvcMatchers("/path") .requestMatchers(new MvcRequestMatcher(introspector, "/path"))
) )
.httpBasic(withDefaults()) .httpBasic(withDefaults())
.authorizeRequests((authorizeRequests) -> .authorizeRequests((authorizeRequests) ->
@ -415,12 +421,14 @@ public class HttpSecurityRequestMatchersTests {
static class RequestMatchersMvcMatcherServeltPathConfig { static class RequestMatchersMvcMatcherServeltPathConfig {
@Bean @Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception {
MvcRequestMatcher.Builder mvcMatcherBuilder = new MvcRequestMatcher.Builder(introspector);
mvcMatcherBuilder.servletPath("/spring");
// @formatter:off // @formatter:off
http http
.requestMatchers() .securityMatchers()
.mvcMatchers("/path").servletPath("/spring") .requestMatchers(mvcMatcherBuilder.pattern("/path"))
.mvcMatchers("/never-match") .requestMatchers("/never-match")
.and() .and()
.httpBasic().and() .httpBasic().and()
.authorizeRequests() .authorizeRequests()
@ -452,13 +460,15 @@ public class HttpSecurityRequestMatchersTests {
static class RequestMatchersMvcMatcherServletPathInLambdaConfig { static class RequestMatchersMvcMatcherServletPathInLambdaConfig {
@Bean @Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception {
MvcRequestMatcher.Builder mvcMatcherBuilder = new MvcRequestMatcher.Builder(introspector);
mvcMatcherBuilder.servletPath("/spring");
// @formatter:off // @formatter:off
http http
.requestMatchers((requestMatchers) -> .securityMatchers((matchers) ->
requestMatchers matchers
.mvcMatchers("/path").servletPath("/spring") .requestMatchers(mvcMatcherBuilder.pattern("/path"))
.mvcMatchers("/never-match") .requestMatchers("/never-match")
) )
.httpBasic(withDefaults()) .httpBasic(withDefaults())
.authorizeRequests((authorizeRequests) -> .authorizeRequests((authorizeRequests) ->

13
config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceHttpAnonymousTests.java
View File

@ -38,6 +38,7 @@ import org.springframework.security.web.SecurityFilterChain;
import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.MockMvc;
import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController; import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
@ -91,6 +92,7 @@ public class NamespaceHttpAnonymousTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class AnonymousConfig { static class AnonymousConfig {
@Bean @Bean
@ -98,7 +100,7 @@ public class NamespaceHttpAnonymousTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/type").anonymous() .requestMatchers("/type").anonymous()
.anyRequest().denyAll(); .anyRequest().denyAll();
return http.build(); return http.build();
// @formatter:on // @formatter:on
@ -131,6 +133,7 @@ public class NamespaceHttpAnonymousTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class AnonymousGrantedAuthorityConfig { static class AnonymousGrantedAuthorityConfig {
@Bean @Bean
@ -138,7 +141,7 @@ public class NamespaceHttpAnonymousTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/type").hasRole("ANON") .requestMatchers("/type").hasRole("ANON")
.anyRequest().denyAll() .anyRequest().denyAll()
.and() .and()
.anonymous() .anonymous()
@ -151,6 +154,7 @@ public class NamespaceHttpAnonymousTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class AnonymousKeyConfig { static class AnonymousKeyConfig {
@Bean @Bean
@ -158,7 +162,7 @@ public class NamespaceHttpAnonymousTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/key").anonymous() .requestMatchers("/key").anonymous()
.anyRequest().denyAll() .anyRequest().denyAll()
.and() .and()
.anonymous().key("AnonymousKeyConfig"); .anonymous().key("AnonymousKeyConfig");
@ -170,6 +174,7 @@ public class NamespaceHttpAnonymousTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class AnonymousUsernameConfig { static class AnonymousUsernameConfig {
@Bean @Bean
@ -177,7 +182,7 @@ public class NamespaceHttpAnonymousTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/principal").anonymous() .requestMatchers("/principal").anonymous()
.anyRequest().denyAll() .anyRequest().denyAll()
.and() .and()
.anonymous().principal("AnonymousUsernameConfig"); .anonymous().principal("AnonymousUsernameConfig");

4
config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceHttpFormLoginTests.java
View File

@ -37,6 +37,7 @@ import org.springframework.security.web.authentication.SimpleUrlAuthenticationFa
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource; import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.MockMvc;
import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder; import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import static org.mockito.ArgumentMatchers.any; import static org.mockito.ArgumentMatchers.any;
import static org.mockito.Mockito.spy; import static org.mockito.Mockito.spy;
@ -111,11 +112,12 @@ public class NamespaceHttpFormLoginTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class FormLoginConfig { static class FormLoginConfig {
@Bean @Bean
WebSecurityCustomizer webSecurityCustomizer() { WebSecurityCustomizer webSecurityCustomizer() {
return (web) -> web.ignoring().antMatchers("/resources/**"); return (web) -> web.ignoring().requestMatchers("/resources/**");
} }
@Bean @Bean

10
config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceHttpInterceptUrlTests.java
View File

@ -39,6 +39,7 @@ import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilde
import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController; import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.authentication; import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.authentication;
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf; import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
@ -110,25 +111,26 @@ public class NamespaceHttpInterceptUrlTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class HttpInterceptUrlConfig { static class HttpInterceptUrlConfig {
@Bean @Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
http http
.authorizeRequests().antMatchers( .authorizeRequests().requestMatchers(
// the line below is similar to intercept-url@pattern: // the line below is similar to intercept-url@pattern:
// <intercept-url pattern="/users**" access="hasRole('ROLE_ADMIN')"/> // <intercept-url pattern="/users**" access="hasRole('ROLE_ADMIN')"/>
//" access="hasRole('ROLE_ADMIN')"/> //" access="hasRole('ROLE_ADMIN')"/>
"/users**", "/sessions/**").hasRole("ADMIN").antMatchers( "/users**", "/sessions/**").hasRole("ADMIN").requestMatchers(
// the line below is similar to intercept-url@method: // the line below is similar to intercept-url@method:
// <intercept-url pattern="/admin/post" access="hasRole('ROLE_ADMIN')" method="POST"/> // <intercept-url pattern="/admin/post" access="hasRole('ROLE_ADMIN')" method="POST"/>
//" access="hasRole('ROLE_ADMIN')" method="POST"/> //" access="hasRole('ROLE_ADMIN')" method="POST"/>
HttpMethod.POST, "/admin/post", "/admin/another-post/**").hasRole("ADMIN") HttpMethod.POST, "/admin/post", "/admin/another-post/**").hasRole("ADMIN")
.antMatchers("/signup").permitAll() .requestMatchers("/signup").permitAll()
.anyRequest().hasRole("USER") .anyRequest().hasRole("USER")
.and() .and()
.requiresChannel().antMatchers("/login", "/secured/**") .requiresChannel().requestMatchers("/login", "/secured/**")
// NOTE: channel security is configured separately of authorization (i.e. intercept-url@access // NOTE: channel security is configured separately of authorization (i.e. intercept-url@access
// the line below is similar to intercept-url@requires-channel="https": // the line below is similar to intercept-url@requires-channel="https":
// <intercept-url pattern="/login" requires-channel="https"/> // <intercept-url pattern="/login" requires-channel="https"/>

4
config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceHttpPortMappingsTests.java
View File

@ -31,6 +31,7 @@ import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager; import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.SecurityFilterChain;
import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.MockMvc;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
@ -62,6 +63,7 @@ public class NamespaceHttpPortMappingsTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class HttpInterceptUrlWithPortMapperConfig { static class HttpInterceptUrlWithPortMapperConfig {
@Bean @Bean
@ -75,7 +77,7 @@ public class NamespaceHttpPortMappingsTests {
.http(9080).mapsTo(9443) .http(9080).mapsTo(9443)
.and() .and()
.requiresChannel() .requiresChannel()
.antMatchers("/login", "/secured/**").requiresSecure() .requestMatchers("/login", "/secured/**").requiresSecure()
.anyRequest().requiresInsecure(); .anyRequest().requiresInsecure();
// @formatter:on // @formatter:on
return http.build(); return http.build();

3
config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceRememberMeTests.java
View File

@ -43,6 +43,7 @@ import org.springframework.security.web.authentication.RememberMeServices;
import org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices; import org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices;
import org.springframework.security.web.authentication.rememberme.PersistentRememberMeToken; import org.springframework.security.web.authentication.rememberme.PersistentRememberMeToken;
import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository; import org.springframework.security.web.authentication.rememberme.PersistentTokenRepository;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.MockMvc;
import org.springframework.test.web.servlet.MvcResult; import org.springframework.test.web.servlet.MvcResult;
import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder; import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
@ -351,7 +352,7 @@ public class NamespaceRememberMeTests {
SecurityFilterChain withoutKeyFilterChain(HttpSecurity http) throws Exception { SecurityFilterChain withoutKeyFilterChain(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
http http
.antMatcher("/without-key/**") .securityMatcher(new AntPathRequestMatcher("/without-key/**"))
.authorizeHttpRequests((requests) -> requests.anyRequest().authenticated()) .authorizeHttpRequests((requests) -> requests.anyRequest().authenticated())
.formLogin() .formLogin()
.loginProcessingUrl("/without-key/login") .loginProcessingUrl("/without-key/login")

21
config/src/test/java/org/springframework/security/config/annotation/web/configurers/RequestMatcherConfigurerTests.java
View File

@ -27,6 +27,7 @@ import org.springframework.security.config.annotation.web.configuration.EnableWe
import org.springframework.security.config.test.SpringTestContext; import org.springframework.security.config.test.SpringTestContext;
import org.springframework.security.config.test.SpringTestContextExtension; import org.springframework.security.config.test.SpringTestContextExtension;
import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.MockMvc;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
@ -77,11 +78,11 @@ public class RequestMatcherConfigurerTests {
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
http http
.requestMatchers() .securityMatchers()
.antMatchers("/api/**") .requestMatchers(new AntPathRequestMatcher("/api/**"))
.and() .and()
.requestMatchers() .securityMatchers()
.antMatchers("/oauth/**") .requestMatchers(new AntPathRequestMatcher("/oauth/**"))
.and() .and()
.authorizeRequests() .authorizeRequests()
.anyRequest().denyAll(); .anyRequest().denyAll();
@ -99,13 +100,13 @@ public class RequestMatcherConfigurerTests {
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
http http
.requestMatchers((requestMatchers) -> .securityMatchers((matchers) ->
requestMatchers matchers
.antMatchers("/api/**") .requestMatchers(new AntPathRequestMatcher("/api/**"))
) )
.requestMatchers((requestMatchers) -> .securityMatchers((matchers) ->
requestMatchers matchers
.antMatchers("/oauth/**") .requestMatchers(new AntPathRequestMatcher("/oauth/**"))
) )
.authorizeRequests((authorizeRequests) -> .authorizeRequests((authorizeRequests) ->
authorizeRequests authorizeRequests

20
config/src/test/java/org/springframework/security/config/annotation/web/configurers/UrlAuthorizationConfigurerTests.java
View File

@ -41,12 +41,14 @@ import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager; import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.FilterChainProxy; import org.springframework.security.web.FilterChainProxy;
import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController; import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.context.support.AnnotationConfigWebApplicationContext; import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
import org.springframework.web.servlet.config.annotation.EnableWebMvc; import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import org.springframework.web.servlet.config.annotation.PathMatchConfigurer; import org.springframework.web.servlet.config.annotation.PathMatchConfigurer;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer; import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThat;
@ -176,12 +178,13 @@ public class UrlAuthorizationConfigurerTests {
static class MvcMatcherConfig { static class MvcMatcherConfig {
@Bean @Bean
SecurityFilterChain filterChain(HttpSecurity http, ApplicationContext context) throws Exception { SecurityFilterChain filterChain(HttpSecurity http, ApplicationContext context,
HandlerMappingIntrospector introspector) throws Exception {
// @formatter:off // @formatter:off
http http
.httpBasic().and() .httpBasic().and()
.apply(new UrlAuthorizationConfigurer(context)).getRegistry() .apply(new UrlAuthorizationConfigurer(context)).getRegistry()
.mvcMatchers("/path").hasRole("ADMIN"); .requestMatchers(new MvcRequestMatcher(introspector, "/path")).hasRole("ADMIN");
// @formatter:on // @formatter:on
return http.build(); return http.build();
} }
@ -209,12 +212,15 @@ public class UrlAuthorizationConfigurerTests {
static class MvcMatcherServletPathConfig { static class MvcMatcherServletPathConfig {
@Bean @Bean
SecurityFilterChain filterChain(HttpSecurity http, ApplicationContext context) throws Exception { SecurityFilterChain filterChain(HttpSecurity http, ApplicationContext context,
HandlerMappingIntrospector introspector) throws Exception {
MvcRequestMatcher mvcRequestMatcher = new MvcRequestMatcher(introspector, "/path");
mvcRequestMatcher.setServletPath("/spring");
// @formatter:off // @formatter:off
http http
.httpBasic().and() .httpBasic().and()
.apply(new UrlAuthorizationConfigurer(context)).getRegistry() .apply(new UrlAuthorizationConfigurer(context)).getRegistry()
.mvcMatchers("/path").servletPath("/spring").hasRole("ADMIN"); .requestMatchers(mvcRequestMatcher).hasRole("ADMIN");
// @formatter:on // @formatter:on
return http.build(); return http.build();
} }
@ -274,9 +280,9 @@ public class UrlAuthorizationConfigurerTests {
http http
.httpBasic(Customizer.withDefaults()) .httpBasic(Customizer.withDefaults())
.apply(new UrlAuthorizationConfigurer<>(context)).getRegistry() .apply(new UrlAuthorizationConfigurer<>(context)).getRegistry()
.mvcMatchers("/test-1").hasRole("ADMIN") .requestMatchers("/test-1").hasRole("ADMIN")
.mvcMatchers("/test-2").hasRole("ADMIN") .requestMatchers("/test-2").hasRole("ADMIN")
.mvcMatchers("/test-3").hasRole("ADMIN") .requestMatchers("/test-3").hasRole("ADMIN")
.anyRequest().hasRole("USER"); .anyRequest().hasRole("USER");
// @formatter:on // @formatter:on
return http.build(); return http.build();

17
config/src/test/java/org/springframework/security/config/annotation/web/configurers/UrlAuthorizationsTests.java
View File

@ -38,6 +38,7 @@ import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.access.intercept.FilterSecurityInterceptor; import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
import org.springframework.test.context.junit.jupiter.SpringExtension; import org.springframework.test.context.junit.jupiter.SpringExtension;
import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.MockMvc;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThat;
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
@ -133,6 +134,7 @@ public class UrlAuthorizationsTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class RoleConfig { static class RoleConfig {
@Bean @Bean
@ -140,12 +142,12 @@ public class UrlAuthorizationsTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/role-user-authority").hasAnyAuthority("ROLE_USER") .requestMatchers("/role-user-authority").hasAnyAuthority("ROLE_USER")
.antMatchers("/role-admin-authority").hasAnyAuthority("ROLE_ADMIN") .requestMatchers("/role-admin-authority").hasAnyAuthority("ROLE_ADMIN")
.antMatchers("/role-user-admin-authority").hasAnyAuthority("ROLE_USER", "ROLE_ADMIN") .requestMatchers("/role-user-admin-authority").hasAnyAuthority("ROLE_USER", "ROLE_ADMIN")
.antMatchers("/role-user").hasAnyRole("USER") .requestMatchers("/role-user").hasAnyRole("USER")
.antMatchers("/role-admin").hasAnyRole("ADMIN") .requestMatchers("/role-admin").hasAnyRole("ADMIN")
.antMatchers("/role-user-admin").hasAnyRole("USER", "ADMIN"); .requestMatchers("/role-user-admin").hasAnyRole("USER", "ADMIN");
return http.build(); return http.build();
// @formatter:on // @formatter:on
} }
@ -154,6 +156,7 @@ public class UrlAuthorizationsTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class NoSpecificAccessDecisionManagerConfig { static class NoSpecificAccessDecisionManagerConfig {
@Bean @Bean
@ -162,7 +165,7 @@ public class UrlAuthorizationsTests {
.apply(new UrlAuthorizationConfigurer(context)).getRegistry(); .apply(new UrlAuthorizationConfigurer(context)).getRegistry();
// @formatter:off // @formatter:off
registry registry
.antMatchers("/a").hasRole("ADMIN") .requestMatchers("/a").hasRole("ADMIN")
.anyRequest().hasRole("USER"); .anyRequest().hasRole("USER");
return http.build(); return http.build();
// @formatter:on // @formatter:on

28
config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurerTests.java
View File

@ -147,6 +147,7 @@ import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RestController; import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.client.RestOperations; import org.springframework.web.client.RestOperations;
import org.springframework.web.context.support.GenericWebApplicationContext; import org.springframework.web.context.support.GenericWebApplicationContext;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType; import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@ -1494,6 +1495,7 @@ public class OAuth2ResourceServerConfigurerTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class DefaultConfig { static class DefaultConfig {
@Bean @Bean
@ -1501,7 +1503,7 @@ public class OAuth2ResourceServerConfigurerTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/requires-read-scope").access("hasAuthority('SCOPE_message:read')") .requestMatchers("/requires-read-scope").access("hasAuthority('SCOPE_message:read')")
.anyRequest().authenticated() .anyRequest().authenticated()
.and() .and()
.oauth2ResourceServer() .oauth2ResourceServer()
@ -1514,6 +1516,7 @@ public class OAuth2ResourceServerConfigurerTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class DefaultInLambdaConfig { static class DefaultInLambdaConfig {
@Bean @Bean
@ -1522,7 +1525,7 @@ public class OAuth2ResourceServerConfigurerTests {
http http
.authorizeRequests((authorizeRequests) -> .authorizeRequests((authorizeRequests) ->
authorizeRequests authorizeRequests
.antMatchers("/requires-read-scope").access("hasAuthority('SCOPE_message:read')") .requestMatchers("/requires-read-scope").access("hasAuthority('SCOPE_message:read')")
.anyRequest().authenticated() .anyRequest().authenticated()
) )
.oauth2ResourceServer((oauth2ResourceServer) -> .oauth2ResourceServer((oauth2ResourceServer) ->
@ -1537,6 +1540,7 @@ public class OAuth2ResourceServerConfigurerTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class JwkSetUriConfig { static class JwkSetUriConfig {
@Value("${mockwebserver.url:https://example.org}") @Value("${mockwebserver.url:https://example.org}")
@ -1547,7 +1551,7 @@ public class OAuth2ResourceServerConfigurerTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/requires-read-scope").access("hasAuthority('SCOPE_message:read')") .requestMatchers("/requires-read-scope").access("hasAuthority('SCOPE_message:read')")
.anyRequest().authenticated() .anyRequest().authenticated()
.and() .and()
.oauth2ResourceServer() .oauth2ResourceServer()
@ -1561,6 +1565,7 @@ public class OAuth2ResourceServerConfigurerTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class JwkSetUriInLambdaConfig { static class JwkSetUriInLambdaConfig {
@Value("${mockwebserver.url:https://example.org}") @Value("${mockwebserver.url:https://example.org}")
@ -1572,7 +1577,7 @@ public class OAuth2ResourceServerConfigurerTests {
http http
.authorizeRequests((authorizeRequests) -> .authorizeRequests((authorizeRequests) ->
authorizeRequests authorizeRequests
.antMatchers("/requires-read-scope").access("hasAuthority('SCOPE_message:read')") .requestMatchers("/requires-read-scope").access("hasAuthority('SCOPE_message:read')")
.anyRequest().authenticated() .anyRequest().authenticated()
) )
.oauth2ResourceServer((oauth2ResourceServer) -> .oauth2ResourceServer((oauth2ResourceServer) ->
@ -1590,6 +1595,7 @@ public class OAuth2ResourceServerConfigurerTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class CsrfDisabledConfig { static class CsrfDisabledConfig {
@Value("${mockwebserver.url:https://example.org}") @Value("${mockwebserver.url:https://example.org}")
@ -1600,7 +1606,7 @@ public class OAuth2ResourceServerConfigurerTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/requires-read-scope").access("hasAuthority('SCOPE_message:read')") .requestMatchers("/requires-read-scope").access("hasAuthority('SCOPE_message:read')")
.anyRequest().authenticated() .anyRequest().authenticated()
.and() .and()
.csrf().disable() .csrf().disable()
@ -1787,6 +1793,7 @@ public class OAuth2ResourceServerConfigurerTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class CustomAuthorityMappingConfig { static class CustomAuthorityMappingConfig {
@Bean @Bean
@ -1794,7 +1801,7 @@ public class OAuth2ResourceServerConfigurerTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/requires-read-scope").access("hasAuthority('message:read')") .requestMatchers("/requires-read-scope").access("hasAuthority('message:read')")
.and() .and()
.oauth2ResourceServer() .oauth2ResourceServer()
.jwt() .jwt()
@ -2326,6 +2333,7 @@ public class OAuth2ResourceServerConfigurerTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class OpaqueTokenConfig { static class OpaqueTokenConfig {
@Bean @Bean
@ -2333,7 +2341,7 @@ public class OAuth2ResourceServerConfigurerTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/requires-read-scope").hasAuthority("SCOPE_message:read") .requestMatchers("/requires-read-scope").hasAuthority("SCOPE_message:read")
.anyRequest().authenticated() .anyRequest().authenticated()
.and() .and()
.oauth2ResourceServer() .oauth2ResourceServer()
@ -2346,6 +2354,7 @@ public class OAuth2ResourceServerConfigurerTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class OpaqueTokenInLambdaConfig { static class OpaqueTokenInLambdaConfig {
@Bean @Bean
@ -2354,7 +2363,7 @@ public class OAuth2ResourceServerConfigurerTests {
http http
.authorizeRequests((authorizeRequests) -> .authorizeRequests((authorizeRequests) ->
authorizeRequests authorizeRequests
.antMatchers("/requires-read-scope").hasAuthority("SCOPE_message:read") .requestMatchers("/requires-read-scope").hasAuthority("SCOPE_message:read")
.anyRequest().authenticated() .anyRequest().authenticated()
) )
.oauth2ResourceServer((oauth2ResourceServer) -> .oauth2ResourceServer((oauth2ResourceServer) ->
@ -2540,6 +2549,7 @@ public class OAuth2ResourceServerConfigurerTests {
@Configuration @Configuration
@EnableWebSecurity @EnableWebSecurity
@EnableWebMvc
static class OpaqueTokenAuthenticationConverterConfig { static class OpaqueTokenAuthenticationConverterConfig {
@Bean @Bean
@ -2547,7 +2557,7 @@ public class OAuth2ResourceServerConfigurerTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/requires-read-scope").hasAuthority("SCOPE_message:read") .requestMatchers("/requires-read-scope").hasAuthority("SCOPE_message:read")
.anyRequest().authenticated() .anyRequest().authenticated()
.and() .and()
.oauth2ResourceServer() .oauth2ResourceServer()

3
config/src/test/java/org/springframework/security/config/http/customconfigurer/CustomConfigurer.java
View File

@ -22,6 +22,7 @@ import org.springframework.security.config.annotation.SecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.FormLoginConfigurer; import org.springframework.security.config.annotation.web.configurers.FormLoginConfigurer;
import org.springframework.security.web.DefaultSecurityFilterChain; import org.springframework.security.web.DefaultSecurityFilterChain;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
/** /**
* @author Rob Winch * @author Rob Winch
@ -43,7 +44,7 @@ public class CustomConfigurer extends SecurityConfigurerAdapter<DefaultSecurityF
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers(this.permitAllPattern).permitAll() .requestMatchers(new AntPathRequestMatcher(this.permitAllPattern)).permitAll()
.anyRequest().authenticated(); .anyRequest().authenticated();
// @formatter:on // @formatter:on
if (http.getConfigurer(FormLoginConfigurer.class) == null) { if (http.getConfigurer(FormLoginConfigurer.class) == null) {

30
config/src/test/kotlin/org/springframework/security/config/annotation/web/CsrfDslTests.kt
View File

@ -255,36 +255,6 @@ class CsrfDslTests {
} }
} }
@Test
fun `CSRF when ignoring ant matchers then CSRF disabled on matching requests`() {
this.spring.register(IgnoringAntMatchersConfig::class.java, BasicController::class.java).autowire()
this.mockMvc.post("/test1")
.andExpect {
status { isForbidden() }
}
this.mockMvc.post("/test2")
.andExpect {
status { isOk() }
}
}
@Configuration
@EnableWebSecurity
open class IgnoringAntMatchersConfig {
@Bean
open fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
http {
csrf {
requireCsrfProtectionMatcher = AntPathRequestMatcher("/**")
ignoringAntMatchers("/test2")
}
}
return http.build()
}
}
@Test @Test
fun `CSRF when ignoring request matchers pattern then CSRF disabled on matching requests`() { fun `CSRF when ignoring request matchers pattern then CSRF disabled on matching requests`() {
this.spring.register(IgnoringRequestMatchersPatternConfig::class.java, BasicController::class.java).autowire() this.spring.register(IgnoringRequestMatchersPatternConfig::class.java, BasicController::class.java).autowire()

6
docs/modules/ROOT/pages/servlet/authorization/authorize-requests.adoc
View File

@ -85,9 +85,9 @@ public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http http
// ... // ...
.authorizeRequests(authorize -> authorize // <1> .authorizeRequests(authorize -> authorize // <1>
.mvcMatchers("/resources/**", "/signup", "/about").permitAll() // <2> .requestMatchers("/resources/**", "/signup", "/about").permitAll() // <2>
.mvcMatchers("/admin/**").hasRole("ADMIN") // <3> .requestMatchers("/admin/**").hasRole("ADMIN") // <3>
.mvcMatchers("/db/**").access("hasRole('ADMIN') and hasRole('DBA')") // <4> .requestMatchers("/db/**").access("hasRole('ADMIN') and hasRole('DBA')") // <4>
.anyRequest().denyAll() // <5> .anyRequest().denyAll() // <5>
); );
return http.build(); return http.build();

2
docs/modules/ROOT/pages/whats-new.adoc
View File

@ -26,3 +26,5 @@ You can configure a different `RequestMatcher` by using the https://docs.spring.
If the application uses `use-expressions="true"` or `access-decision-manager-ref` switch to `use-expressions="false"` or `authorization-manager-ref`, respectively. If the application uses `use-expressions="true"` or `access-decision-manager-ref` switch to `use-expressions="false"` or `authorization-manager-ref`, respectively.
If application relies on the implicit `<intercept-url pattern="/**" access="permitAll"/>`, this is no longer implicit and needs to be specified. If application relies on the implicit `<intercept-url pattern="/**" access="permitAll"/>`, this is no longer implicit and needs to be specified.
Or use `use-authorization-manager="false"` Or use `use-authorization-manager="false"`
* https://github.com/spring-projects/spring-security/issues/11939[gh-11939] - Remove deprecated `antMatchers`, `mvcMatchers`, `regexMatchers` helper methods from Java Configuration.
Instead, use `requestMatchers` or `HttpSecurity#securityMatchers`.

4
test/src/test/java/org/springframework/security/test/web/servlet/request/Sec2935Tests.java
View File

@ -35,6 +35,7 @@ import org.springframework.test.context.web.WebAppConfiguration;
import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.MockMvc;
import org.springframework.test.web.servlet.setup.MockMvcBuilders; import org.springframework.test.web.servlet.setup.MockMvcBuilders;
import org.springframework.web.context.WebApplicationContext; import org.springframework.web.context.WebApplicationContext;
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user; import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user;
import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated; import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated;
@ -111,6 +112,7 @@ public class Sec2935Tests {
@EnableWebSecurity @EnableWebSecurity
@Configuration @Configuration
@EnableWebMvc
static class Config { static class Config {
@Bean @Bean
@ -118,7 +120,7 @@ public class Sec2935Tests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/admin/**").hasRole("ADMIN") .requestMatchers("/admin/**").hasRole("ADMIN")
.anyRequest().authenticated() .anyRequest().authenticated()
.and() .and()
.httpBasic(); .httpBasic();

2
test/src/test/java/org/springframework/security/test/web/servlet/request/SecurityMockMvcRequestPostProcessorsOAuth2LoginTests.java
View File

@ -153,7 +153,7 @@ public class SecurityMockMvcRequestPostProcessorsOAuth2LoginTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests((authorize) -> authorize .authorizeRequests((authorize) -> authorize
.mvcMatchers("/admin/**").hasAuthority("SCOPE_admin") .requestMatchers("/admin/**").hasAuthority("SCOPE_admin")
.anyRequest().hasAuthority("SCOPE_read") .anyRequest().hasAuthority("SCOPE_read")
).oauth2Login(); ).oauth2Login();
return http.build(); return http.build();

2
test/src/test/java/org/springframework/security/test/web/servlet/request/SecurityMockMvcRequestPostProcessorsOidcLoginTests.java
View File

@ -155,7 +155,7 @@ public class SecurityMockMvcRequestPostProcessorsOidcLoginTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.mvcMatchers("/admin/**").hasAuthority("SCOPE_admin") .requestMatchers("/admin/**").hasAuthority("SCOPE_admin")
.anyRequest().hasAuthority("SCOPE_read") .anyRequest().hasAuthority("SCOPE_read")
.and() .and()
.oauth2Login(); .oauth2Login();

2
test/src/test/java/org/springframework/security/test/web/servlet/request/SecurityMockMvcRequestPostProcessorsOpaqueTokenTests.java
View File

@ -127,7 +127,7 @@ public class SecurityMockMvcRequestPostProcessorsOpaqueTokenTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.mvcMatchers("/admin/**").hasAuthority("SCOPE_admin") .requestMatchers("/admin/**").hasAuthority("SCOPE_admin")
.anyRequest().hasAuthority("SCOPE_read") .anyRequest().hasAuthority("SCOPE_read")
.and() .and()
.oauth2ResourceServer() .oauth2ResourceServer()

2
test/src/test/java/org/springframework/security/test/web/servlet/response/Gh3409Tests.java
View File

@ -99,7 +99,7 @@ public class Gh3409Tests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/public/**").permitAll() .requestMatchers("/public/**").permitAll()
.anyRequest().authenticated() .anyRequest().authenticated()
.and() .and()
.formLogin().and() .formLogin().and()

2
test/src/test/java/org/springframework/security/test/web/servlet/showcase/secured/DefaultfSecurityRequestsTests.java
View File

@ -96,7 +96,7 @@ public class DefaultfSecurityRequestsTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/admin/**").hasRole("ADMIN") .requestMatchers("/admin/**").hasRole("ADMIN")
.anyRequest().authenticated() .anyRequest().authenticated()
.and() .and()
.httpBasic(); .httpBasic();

2
test/src/test/java/org/springframework/security/test/web/servlet/showcase/secured/SecurityRequestsTests.java
View File

@ -113,7 +113,7 @@ public class SecurityRequestsTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/admin/**").hasRole("ADMIN") .requestMatchers("/admin/**").hasRole("ADMIN")
.anyRequest().authenticated() .anyRequest().authenticated()
.and() .and()
.formLogin(); .formLogin();

2
test/src/test/java/org/springframework/security/test/web/servlet/showcase/secured/WithUserAuthenticationTests.java
View File

@ -97,7 +97,7 @@ public class WithUserAuthenticationTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/admin/**").hasRole("ADMIN") .requestMatchers("/admin/**").hasRole("ADMIN")
.anyRequest().authenticated() .anyRequest().authenticated()
.and() .and()
.formLogin(); .formLogin();

2
test/src/test/java/org/springframework/security/test/web/servlet/showcase/secured/WithUserClassLevelAuthenticationTests.java
View File

@ -97,7 +97,7 @@ public class WithUserClassLevelAuthenticationTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/admin/**").hasRole("ADMIN") .requestMatchers("/admin/**").hasRole("ADMIN")
.anyRequest().authenticated() .anyRequest().authenticated()
.and() .and()
.httpBasic(); .httpBasic();

2
test/src/test/java/org/springframework/security/test/web/servlet/showcase/secured/WithUserDetailsAuthenticationTests.java
View File

@ -88,7 +88,7 @@ public class WithUserDetailsAuthenticationTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/admin/**").hasRole("ADMIN") .requestMatchers("/admin/**").hasRole("ADMIN")
.anyRequest().authenticated() .anyRequest().authenticated()
.and() .and()
.formLogin(); .formLogin();

2
test/src/test/java/org/springframework/security/test/web/servlet/showcase/secured/WithUserDetailsClassLevelAuthenticationTests.java
View File

@ -87,7 +87,7 @@ public class WithUserDetailsClassLevelAuthenticationTests {
// @formatter:off // @formatter:off
http http
.authorizeRequests() .authorizeRequests()
.antMatchers("/admin/**").hasRole("ADMIN") .requestMatchers("/admin/**").hasRole("ADMIN")
.anyRequest().authenticated() .anyRequest().authenticated()
.and() .and()
.formLogin(); .formLogin();

3
test/src/test/java/org/springframework/security/test/web/support/WebTestUtilsTests.java
View File

@ -40,6 +40,7 @@ import org.springframework.security.web.context.SecurityContextRepository;
import org.springframework.security.web.csrf.CsrfFilter; import org.springframework.security.web.csrf.CsrfFilter;
import org.springframework.security.web.csrf.CsrfTokenRepository; import org.springframework.security.web.csrf.CsrfTokenRepository;
import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository; import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.AnyRequestMatcher; import org.springframework.security.web.util.matcher.AnyRequestMatcher;
import org.springframework.web.context.WebApplicationContext; import org.springframework.web.context.WebApplicationContext;
import org.springframework.web.context.support.AnnotationConfigWebApplicationContext; import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
@ -225,7 +226,7 @@ public class WebTestUtilsTests {
SecurityFilterChain filterChain(HttpSecurity http) throws Exception { SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// @formatter:off // @formatter:off
http http
.antMatcher("/willnotmatchthis"); .securityMatcher(new AntPathRequestMatcher("/willnotmatchthis"));
return http.build(); return http.build();
// @formatter:on // @formatter:on
} }