Ant Matcher for GET Parameters

user_9134524 0
Viewed 5258

Using Java + SpringBoot, I'm trying to create and endpoint for confirming the user email.

The link I generated and sent was /confirm-email?id=x&token=xyztetc

However, due to the fact that only /signup is permitted to be accessed without a Bearer token, the link will always get a 403 response. I've tried to add /confirm-email?{id:.+}&{token:.+} for being permitted, but with no success.

I'm 100% sure that the regex isn't correctly written, but I can't find any relevant Ant pattern documentation to check.

spring-boot ant spring java
2 Answers
user_6572240

In order to allow regex matchers, you must use .regexMatchers() instead of .antMatchers().

See this class for more information:

org.springframework.security.web.util.matcher.RegexRequestMatcher

It would be something like this in your case:

public class ServerSecurityAppConfig extends ResourceServerConfigurerAdapter {

    // ...

    private static final String[] UNAUTHENTICATED_ROUTES = new String[] {
            "/confirm-email?{.+}&{.+}",
    };


    @Override
    public void configure(final HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .regexMatchers( UNAUTHENTICATED_ROUTES ).permitAll()
                .anyRequest().access( myAppSecurityExpression );
    }
user_38973050
Related