DEV Community

Cover image for New requestMatchers in Spring Security 6
JavaFullStackDev.in
JavaFullStackDev.in

Posted on

25

New requestMatchers in Spring Security 6

In Spring Security 6, the requestMatchers methods have replaced the deprecated antMatchers, mvcMatchers, and regexMatchers methods for configuring path-based access control. Here are the key points about the new requestMatchers:

Use requestMatchers in authorizeHttpRequests

The authorizeHttpRequests method in HttpSecurity configuration allows you to configure fine-grained request matching for access control. You can use the requestMatchers method to specify which requests should be permitted or authenticated. For example:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http.authorizeHttpRequests(auth -> auth
        .requestMatchers("/greet").permitAll()
        .anyRequest().authenticated())
        .formLogin()
        .build();
}
Enter fullscreen mode Exit fullscreen mode

This configuration permits access to the /greet endpoint without authentication while requiring authentication for all other requests.

requestMatchers vs securityMatchers

There are two similar methods: requestMatchers and securityMatchers. Both choose the most appropriate RequestMatcher implementation based on the presence of Spring MVC in the classpath:

  • If Spring MVC is present, it uses MvcRequestMatcher
  • If Spring MVC is not present, it falls back to AntPathRequestMatcher

The main difference is that securityMatchers is used in places like WebSecurityCustomizer, while requestMatchers is used in authorizeHttpRequests.

Choosing the Right Matcher

The requestMatchers methods allow you to match requests based on patterns or other criteria without relying on specific matchers like AntPathRequestMatcher or RegexRequestMatcher. This provides more flexibility and better defaults.

To use a specific matcher, you can pass a RequestMatcher implementation to the requestMatchers method:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http.authorizeHttpRequests(auth -> auth
        .requestMatchers(new AntPathRequestMatcher("/greet")).permitAll()
        .anyRequest().authenticated())
        .formLogin()
        .build();
}
Enter fullscreen mode Exit fullscreen mode

In summary, the new requestMatchers methods in Spring Security 6 provide a more flexible and secure way to configure path-based access control, choosing the most appropriate RequestMatcher implementation based on the application's dependencies.

Billboard image

The Next Generation Developer Platform

Coherence is the first Platform-as-a-Service you can control. Unlike "black-box" platforms that are opinionated about the infra you can deploy, Coherence is powered by CNC, the open-source IaC framework, which offers limitless customization.

Learn more

Top comments (0)

Heroku

This site is built on Heroku

Join the ranks of developers at Salesforce, Airbase, DEV, and more who deploy their mission critical applications on Heroku. Sign up today and launch your first app!

Get Started

👋 Kindness is contagious

Discover a treasure trove of wisdom within this insightful piece, highly respected in the nurturing DEV Community enviroment. Developers, whether novice or expert, are encouraged to participate and add to our shared knowledge basin.

A simple "thank you" can illuminate someone's day. Express your appreciation in the comments section!

On DEV, sharing ideas smoothens our journey and strengthens our community ties. Learn something useful? Offering a quick thanks to the author is deeply appreciated.

Okay