Spring Security: what do authorizeRequests(), anyRequest() and authenticated() do?

user_12988325 0
Viewed 5753

In the below code what do the different chained methods do?

protected void configure(HttpSecurity http ) throws Exception {

    http.authorizeRequests()
        .antMatchers(PUBLIC_URL).permitAll()
        .anyRequest().authenticated();
    
}

NOTE: PUBLIC_URL is an array of strings containing public URLs.

spring-boot spring-security rest spring java
2 Answers

  • authorizeRequests() Allows restricting access based upon the HttpServletRequest using RequestMatcher implementations.

  • permitAll() This will allow the public access that is anyone can access endpoint PUBLIC_URL without authentication.

  • anyRequest().authenticated() will restrict the access for any other endpoint other than PUBLIC_URL, and the user must be authenticated.

We can also configure access based on authorities, can manage the sessions, HTTPS channel and much more. You may find more details from configure(HttpSecurity http).

user_109612380

It means that all requests must be authenticated except those matching PUBLIC_URL

user_102206290
Related