Spring/spring-boot
Spring/spring-boot
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-boot.git synced 2024-07-05 00:56:58 +08:00
Code Issues Packages Projects Releases Wiki Activity

Use explicit matchers following Spring Security 6.0.5 upgrade

Browse Source 
See gh-36293
This commit is contained in:
Phillip Webb 2023-07-18 09:49:11 +01:00
parent 12011fb4d9
commit 0233178855
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator-custom-security/src/main/java/smoketest/actuator/customsecurity/SecurityConfiguration.java
View File

@ -31,6 +31,9 @@ import org.springframework.security.core.userdetails.User.UserBuilder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
@Configuration(proxyBeanMethods = false)
public class SecurityConfiguration {
@ -54,16 +57,18 @@ public class SecurityConfiguration {
}
@Bean
SecurityFilterChain configure(HttpSecurity http) throws Exception {
SecurityFilterChain configure(HttpSecurity http, HandlerMappingIntrospector handlerMappingIntrospector)
throws Exception {
http.authorizeHttpRequests((requests) -> {
requests.requestMatchers("/actuator/beans").hasRole("BEANS");
requests.requestMatchers(new MvcRequestMatcher(handlerMappingIntrospector, "/actuator/beans"))
.hasRole("BEANS");
requests.requestMatchers(EndpointRequest.to("health")).permitAll();
requests.requestMatchers(EndpointRequest.toAnyEndpoint().excluding(MappingsEndpoint.class))
.hasRole("ACTUATOR");
requests.requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll();
requests.requestMatchers("/foo").permitAll();
requests.requestMatchers("/error").permitAll();
requests.requestMatchers("/**").hasRole("USER");
requests.requestMatchers(new AntPathRequestMatcher("/error")).permitAll();
requests.requestMatchers(new AntPathRequestMatcher("/**")).hasRole("USER");
});
http.cors(Customizer.withDefaults());
http.httpBasic();