Do not call Spring Security pre-authentication filter for specific URL and HTTP method

Question

I have a custom pre-authentication filter which basically validates and creates a token.

I just want to call this pre-authentication filter only for secured APIs.

For example, I have these two APIs:

GET /api/products (not secure)
POST /api/products (secure)

When I use:

<http pattern="/api/products" security="none"/>

My pre-authentication filter is not called, but doing this I turn both APIs unsecure, because both have the same pattern /api/products.

I want to get my pre-authentication filter called only for my secure API, which is POST /api/products.

The question is: how to tell security="none" to differentiate HTTP methods (GET and POST)?

dur · Accepted Answer · 2017-01-23 22:09:13Z

1

You can define a RequestMatcher like AntPathRequestMatcher and add the reference, see Spring Security Reference:

request-matcher-ref A reference to a bean that implements RequestMatcher that will determine if this FilterChain should be used. This is a more powerful alternative to pattern.

Your modified configuration:

<http request-matcher-ref="myMatcher"/>

<b:bean id="myMatcher" class="org.springframework.security.web.util.matcher.AntPathRequestMatcher">
    <b:constructor-arg value="/api/products"/>
    <b:constructor-arg value="POST"/>
</b:bean>

edited Jan 23, 2017 at 22:09

answered Jan 23, 2017 at 21:28

dur

17.3k26 gold badges93 silver badges146 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Do not call Spring Security pre-authentication filter for specific URL and HTTP method

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related