Examples with MvcRequestMatcher org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher used on opensource projects

Example 1 with MvcRequestMatcher

use of org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher in project spring-security by spring-projects.

the class AbstractRequestMatcherRegistry method createMvcMatchers.

/**
 * Creates {@link MvcRequestMatcher} instances for the method and patterns passed in
 * @param method the HTTP method to use or null if any should be used
 * @param mvcPatterns the Spring MVC patterns to match on
 * @return a List of {@link MvcRequestMatcher} instances
 */
protected final List<MvcRequestMatcher> createMvcMatchers(HttpMethod method, String... mvcPatterns) {
    Assert.state(!this.anyRequestConfigured, "Can't configure mvcMatchers after anyRequest");
    ObjectPostProcessor<Object> opp = this.context.getBean(ObjectPostProcessor.class);
    if (!this.context.containsBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME)) {
        throw new NoSuchBeanDefinitionException("A Bean named " + HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME + " of type " + HandlerMappingIntrospector.class.getName() + " is required to use MvcRequestMatcher. Please ensure Spring Security & Spring MVC are configured in a shared ApplicationContext.");
    }
    HandlerMappingIntrospector introspector = this.context.getBean(HANDLER_MAPPING_INTROSPECTOR_BEAN_NAME, HandlerMappingIntrospector.class);
    List<MvcRequestMatcher> matchers = new ArrayList<>(mvcPatterns.length);
    for (String mvcPattern : mvcPatterns) {
        MvcRequestMatcher matcher = new MvcRequestMatcher(introspector, mvcPattern);
        opp.postProcess(matcher);
        if (method != null) {
            matcher.setMethod(method);
        }
        matchers.add(matcher);
    }
    return matchers;
}

Example 2 with MvcRequestMatcher

use of org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher in project spring-security by spring-projects.

the class HttpSecurity method mvcMatcher.

/**
 * Allows configuring the {@link HttpSecurity} to only be invoked when matching the
 * provided Spring MVC pattern. If more advanced configuration is necessary, consider
 * using {@link #requestMatchers()} or {@link #requestMatcher(RequestMatcher)}.
 *
 * <p>
 * Invoking {@link #mvcMatcher(String)} will override previous invocations of
 * {@link #mvcMatcher(String)}}, {@link #requestMatchers()},
 * {@link #antMatcher(String)}, {@link #regexMatcher(String)}, and
 * {@link #requestMatcher(RequestMatcher)}.
 * </p>
 * @param mvcPattern the Spring MVC Pattern to match on (i.e. "/admin/**")
 * @return the {@link HttpSecurity} for further customizations
 * @see MvcRequestMatcher
 */
public HttpSecurity mvcMatcher(String mvcPattern) {
    HandlerMappingIntrospector introspector = new HandlerMappingIntrospector();
    introspector.setApplicationContext(getContext());
    introspector.afterPropertiesSet();
    return requestMatcher(new MvcRequestMatcher(introspector, mvcPattern));
}

Example 3 with MvcRequestMatcher

use of org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher in project spring-security by spring-projects.

the class RequestMatcherDelegatingAuthorizationManagerTests method checkWhenMultipleMappingsConfiguredWithConsumerThenDelegatesMatchingManager.

@Test
public void checkWhenMultipleMappingsConfiguredWithConsumerThenDelegatesMatchingManager() {
    RequestMatcherDelegatingAuthorizationManager manager = RequestMatcherDelegatingAuthorizationManager.builder().mappings((m) -> {
        m.put(new MvcRequestMatcher(null, "/grant"), (a, o) -> new AuthorizationDecision(true));
        m.put(AnyRequestMatcher.INSTANCE, AuthorityAuthorizationManager.hasRole("ADMIN"));
        m.put(new MvcRequestMatcher(null, "/deny"), (a, o) -> new AuthorizationDecision(false));
        m.put(new MvcRequestMatcher(null, "/afterAny"), (a, o) -> new AuthorizationDecision(true));
    }).build();
    Supplier<Authentication> authentication = () -> new TestingAuthenticationToken("user", "password", "ROLE_USER");
    AuthorizationDecision grant = manager.check(authentication, new MockHttpServletRequest(null, "/grant"));
    assertThat(grant).isNotNull();
    assertThat(grant.isGranted()).isTrue();
    AuthorizationDecision deny = manager.check(authentication, new MockHttpServletRequest(null, "/deny"));
    assertThat(deny).isNotNull();
    assertThat(deny.isGranted()).isFalse();
    AuthorizationDecision afterAny = manager.check(authentication, new MockHttpServletRequest(null, "/afterAny"));
    assertThat(afterAny).isNotNull();
    assertThat(afterAny.isGranted()).isFalse();
    AuthorizationDecision unmapped = manager.check(authentication, new MockHttpServletRequest(null, "/unmapped"));
    assertThat(unmapped).isNotNull();
    assertThat(unmapped.isGranted()).isFalse();
}

Example 4 with MvcRequestMatcher

use of org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher in project spring-security by spring-projects.

the class RequestMatcherDelegatingAuthorizationManagerTests method checkWhenMultipleMappingsConfiguredThenDelegatesMatchingManager.

@Test
public void checkWhenMultipleMappingsConfiguredThenDelegatesMatchingManager() {
    RequestMatcherDelegatingAuthorizationManager manager = RequestMatcherDelegatingAuthorizationManager.builder().add(new MvcRequestMatcher(null, "/grant"), (a, o) -> new AuthorizationDecision(true)).add(new MvcRequestMatcher(null, "/deny"), (a, o) -> new AuthorizationDecision(false)).add(new MvcRequestMatcher(null, "/neutral"), (a, o) -> null).build();
    Supplier<Authentication> authentication = () -> new TestingAuthenticationToken("user", "password", "ROLE_USER");
    AuthorizationDecision grant = manager.check(authentication, new MockHttpServletRequest(null, "/grant"));
    assertThat(grant).isNotNull();
    assertThat(grant.isGranted()).isTrue();
    AuthorizationDecision deny = manager.check(authentication, new MockHttpServletRequest(null, "/deny"));
    assertThat(deny).isNotNull();
    assertThat(deny.isGranted()).isFalse();
    AuthorizationDecision neutral = manager.check(authentication, new MockHttpServletRequest(null, "/neutral"));
    assertThat(neutral).isNull();
    AuthorizationDecision abstain = manager.check(authentication, new MockHttpServletRequest(null, "/abstain"));
    assertThat(abstain).isNull();
}