Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add Multiple Filter Chains Docs 

Closes gh-9178
This commit is contained in:
Guillaume Berche 2020-10-29 10:33:35 +01:00 committed by Josh Cummings
parent ab9a310485
commit 69336fb3ec
No known key found for this signature in database
GPG Key ID: 49EF60DD7FF83443
1 changed files with 56 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
docs/manual/src/docs/asciidoc/_includes/reactive/webflux.adoc
View File

@ -125,5 +125,60 @@ class HelloWebfluxSecurityConfig {
This configuration explicitly sets up all the same things as our minimal configuration.
From here you can easily make the changes to the defaults.
You can find more examples of explicit configuration in unit tests, by searching https://github.com/spring-projects/spring-security/search?q=path%3Aconfig%2Fsrc%2Ftest%2F+EnableWebFluxSecurity[EnableWebFluxSecurity in the `config/src/test/` directory], e.g. https://github.com/spring-projects/spring-security/blob/9cf3129d7afa2abb439aba6aadfee0a2c8c784bf/config/src/test/java/org/springframework/security/config/annotation/web/reactive/EnableWebFluxSecurityTests.java#L349-L366[MultiSecurityHttpConfig] illustrating multiple `SecurityWebFilterChain` beans.
You can find more examples of explicit configuration in unit tests, by searching https://github.com/spring-projects/spring-security/search?q=path%3Aconfig%2Fsrc%2Ftest%2F+EnableWebFluxSecurity[EnableWebFluxSecurity in the `config/src/test/` directory].
[[jc-webflux-multiple-filter-chains]]
=== Multiple chains support
We can configure multiple `SecurityWebFilterChain` instances.
For example, the following is an example of having a specific configuration for URL's that start with `/api/`. This overrides the form login configuration with lower precedence.
[source,java]
----
@EnableWebFluxSecurity
@Import(ReactiveAuthenticationTestConfiguration.class)
static class MultiSecurityHttpConfig {
@Order(Ordered.HIGHEST_PRECEDENCE) <1>
@Bean
SecurityWebFilterChain apiHttpSecurity(ServerHttpSecurity http) {
http
.securityMatcher(new PathPatternParserServerWebExchangeMatcher("/api/**")) <2>
.authorizeExchange()
.anyExchange().denyAll();
return http.build();
}
@Bean
SecurityWebFilterChain webFormHttpSecurity(ServerHttpSecurity http) { <3>
http
.authorizeExchange((exchanges) ->
exchanges
.pathMatchers("/login").permitAll()
.anyExchange().authenticated()
)
.httpBasic(withDefaults())
.formLogin((formLogin) -> <4>
formLogin
.loginPage("/login")
);
return http.build();
}
@Bean
public static ReactiveUserDetailsService userDetailsService() {
return new MapReactiveUserDetailsService(PasswordEncodedUser.user(), PasswordEncodedUser.admin());
}
}
----
<1> Configure a SecurityWebFilterChain with an `@Order` to specify which `SecurityWebFilterChain` should be considered first
<2> The `PathPatternParserServerWebExchangeMatcher` states that this `SecurityWebFilterChain` will only be applicable to URLs that start with `/api/`
<3> Create another instance of `SecurityWebFilterChain` with lower precedence.
<4> Some configurations applies to all path matchers within the `webFormHttpSecurity` but not to `apiHttpSecurity` `SecurityWebFilterChain`.
If the URL does not start with `/api/` the `webFormHttpSecurity` configuration will be used.