Skip to content

Commit 2c87270

Browse files
jzheauxjzheaux
committed
Use authorizeHttpRequests
Issue gh-15174
1 parent dadf108 commit 2c87270

File tree

94 files changed

+611
-839
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

94 files changed

+611
-839
lines changed

‎config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java

Lines changed: 37 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -331,8 +331,8 @@ public HttpSecurity cors(Customizer<CorsConfigurer<HttpSecurity>> corsCustomizer
331331
* &#064;Bean
332332
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
333333
* http
334-
* .authorizeRequests((authorizeRequests) -&gt;
335-
* authorizeRequests
334+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
335+
* authorizeHttpRequests
336336
* .anyRequest().hasRole(&quot;USER&quot;)
337337
* )
338338
* .formLogin((formLogin) -&gt;
@@ -465,8 +465,8 @@ public HttpSecurity portMapper(Customizer<PortMapperConfigurer<HttpSecurity>> po
465465
* &#064;Bean
466466
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
467467
* http
468-
* .authorizeRequests((authorizeRequests) -&gt;
469-
* authorizeRequests
468+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
469+
* authorizeHttpRequests
470470
* .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
471471
* )
472472
* .jee((jee) -&gt;
@@ -545,8 +545,8 @@ public HttpSecurity jee(Customizer<JeeConfigurer<HttpSecurity>> jeeCustomizer) t
545545
* &#064;Bean
546546
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
547547
* http
548-
* .authorizeRequests((authorizeRequests) -&gt;
549-
* authorizeRequests
548+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
549+
* authorizeHttpRequests
550550
* .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
551551
* )
552552
* .x509(withDefaults());
@@ -582,8 +582,8 @@ public HttpSecurity x509(Customizer<X509Configurer<HttpSecurity>> x509Customizer
582582
* &#064;Bean
583583
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
584584
* http
585-
* .authorizeRequests((authorizeRequests) -&gt;
586-
* authorizeRequests
585+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
586+
* authorizeHttpRequests
587587
* .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
588588
* )
589589
* .formLogin(withDefaults())
@@ -865,8 +865,8 @@ public HttpSecurity authorizeHttpRequests(
865865
* &#064;Bean
866866
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
867867
* http
868-
* .authorizeRequests((authorizeRequests) -&gt;
869-
* authorizeRequests
868+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
869+
* authorizeHttpRequests
870870
* .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
871871
* )
872872
* .requestCache((requestCache) -&gt;
@@ -904,8 +904,8 @@ public HttpSecurity requestCache(Customizer<RequestCacheConfigurer<HttpSecurity>
904904
* &#064;Bean
905905
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
906906
* http
907-
* .authorizeRequests((authorizeRequests) -&gt;
908-
* authorizeRequests
907+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
908+
* authorizeHttpRequests
909909
* .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
910910
* )
911911
* // sample exception handling customization
@@ -1042,8 +1042,8 @@ public HttpSecurity csrf(Customizer<CsrfConfigurer<HttpSecurity>> csrfCustomizer
10421042
* &#064;Bean
10431043
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
10441044
* http
1045-
* .authorizeRequests((authorizeRequests) -&gt;
1046-
* authorizeRequests
1045+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
1046+
* authorizeHttpRequests
10471047
* .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
10481048
* )
10491049
* .formLogin(withDefaults())
@@ -1098,8 +1098,8 @@ public HttpSecurity logout(Customizer<LogoutConfigurer<HttpSecurity>> logoutCust
10981098
* &#064;Bean
10991099
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
11001100
* http
1101-
* .authorizeRequests((authorizeRequests) -&gt;
1102-
* authorizeRequests
1101+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
1102+
* authorizeHttpRequests
11031103
* .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
11041104
* )
11051105
* .formLogin(withDefaults())
@@ -1135,8 +1135,8 @@ public HttpSecurity logout(Customizer<LogoutConfigurer<HttpSecurity>> logoutCust
11351135
* &#064;Bean
11361136
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
11371137
* http
1138-
* .authorizeRequests((authorizeRequests) -&gt;
1139-
* authorizeRequests
1138+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
1139+
* authorizeHttpRequests
11401140
* .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
11411141
* )
11421142
* .formLogin(withDefaults())
@@ -1188,8 +1188,8 @@ public HttpSecurity anonymous(Customizer<AnonymousConfigurer<HttpSecurity>> anon
11881188
* &#064;Bean
11891189
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
11901190
* http
1191-
* .authorizeRequests((authorizeRequests) -&gt;
1192-
* authorizeRequests
1191+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
1192+
* authorizeHttpRequests
11931193
* .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
11941194
* )
11951195
* .formLogin(withDefaults());
@@ -1218,8 +1218,8 @@ public HttpSecurity anonymous(Customizer<AnonymousConfigurer<HttpSecurity>> anon
12181218
* &#064;Bean
12191219
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
12201220
* http
1221-
* .authorizeRequests((authorizeRequests) -&gt;
1222-
* authorizeRequests
1221+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
1222+
* authorizeHttpRequests
12231223
* .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
12241224
* )
12251225
* .formLogin((formLogin) -&gt;
@@ -1298,8 +1298,8 @@ public HttpSecurity formLogin(Customizer<FormLoginConfigurer<HttpSecurity>> form
12981298
* &#064;Bean
12991299
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
13001300
* http
1301-
* .authorizeRequests((authorizeRequests) -&gt;
1302-
* authorizeRequests
1301+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
1302+
* authorizeHttpRequests
13031303
* .anyRequest().authenticated()
13041304
* )
13051305
* .saml2Login(withDefaults());
@@ -1387,7 +1387,7 @@ public HttpSecurity saml2Login(Customizer<Saml2LoginConfigurer<HttpSecurity>> sa
13871387
* &#064;Bean
13881388
* public SecurityFilterChain web(HttpSecurity http) throws Exception {
13891389
* http
1390-
* .authorizeRequests((authorize) -&gt; authorize
1390+
* .authorizeHttpRequests((authorize) -&gt; authorize
13911391
* .anyRequest().authenticated()
13921392
* )
13931393
* .saml2Login(withDefaults())
@@ -1516,8 +1516,8 @@ public HttpSecurity saml2Metadata(Customizer<Saml2MetadataConfigurer<HttpSecurit
15161516
* &#064;Bean
15171517
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
15181518
* http
1519-
* .authorizeRequests((authorizeRequests) -&gt;
1520-
* authorizeRequests
1519+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
1520+
* authorizeHttpRequests
15211521
* .anyRequest().authenticated()
15221522
* )
15231523
* .oauth2Login(withDefaults());
@@ -1596,8 +1596,8 @@ public HttpSecurity oidcLogout(Customizer<OidcLogoutConfigurer<HttpSecurity>> oi
15961596
* &#064;Bean
15971597
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
15981598
* http
1599-
* .authorizeRequests((authorizeRequests) -&gt;
1600-
* authorizeRequests
1599+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
1600+
* authorizeHttpRequests
16011601
* .anyRequest().authenticated()
16021602
* )
16031603
* .oauth2Client(withDefaults());
@@ -1635,8 +1635,8 @@ public HttpSecurity oauth2Client(Customizer<OAuth2ClientConfigurer<HttpSecurity>
16351635
* &#064;Bean
16361636
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
16371637
* http
1638-
* .authorizeRequests((authorizeRequests) -&gt;
1639-
* authorizeRequests
1638+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
1639+
* authorizeHttpRequests
16401640
* .anyRequest().authenticated()
16411641
* )
16421642
* .oauth2ResourceServer((oauth2ResourceServer) -&gt;
@@ -1731,8 +1731,8 @@ public HttpSecurity oneTimeTokenLogin(
17311731
* &#064;Bean
17321732
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
17331733
* http
1734-
* .authorizeRequests((authorizeRequests) -&gt;
1735-
* authorizeRequests
1734+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
1735+
* authorizeHttpRequests
17361736
* .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
17371737
* )
17381738
* .formLogin(withDefaults())
@@ -1833,8 +1833,8 @@ public HttpSecurity redirectToHttps(
18331833
* &#064;Bean
18341834
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
18351835
* http
1836-
* .authorizeRequests((authorizeRequests) -&gt;
1837-
* authorizeRequests
1836+
* .authorizeHttpRequests((authorizeHttpRequests) -&gt;
1837+
* authorizeHttpRequests
18381838
* .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
18391839
* )
18401840
* .httpBasic(withDefaults());
@@ -1878,8 +1878,8 @@ public HttpSecurity httpBasic(Customizer<HttpBasicConfigurer<HttpSecurity>> http
18781878
* &#064;Bean
18791879
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
18801880
* http
1881-
* .authorizeRequests(authorizeRequests -&gt;
1882-
* authorizeRequests
1881+
* .authorizeHttpRequests(authorizeHttpRequests -&gt;
1882+
* authorizeHttpRequests
18831883
* .requestMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
18841884
* )
18851885
* .passwordManagement(passwordManagement -&gt;

‎config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurityFilterChainValidator.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -99,11 +99,11 @@ private void checkAuthorizationFilters(List<SecurityFilterChain> chains) {
9999
}
100100
if (authorizationFilter != null && filterSecurityInterceptor != null) {
101101
this.logger.warn(
102-
"It is not recommended to use authorizeRequests in the configuration. Please only use authorizeHttpRequests");
102+
"It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration. Please only use authorizeHttpRequests");
103103
}
104104
if (filterSecurityInterceptor != null) {
105105
this.logger.warn(
106-
"Usage of authorizeRequests is deprecated. Please use authorizeHttpRequests in the configuration");
106+
"Usage of authorizeRequests and FilterSecurityInterceptor are deprecated. Please use authorizeHttpRequests in the configuration");
107107
}
108108
authorizationFilter = null;
109109
filterSecurityInterceptor = null;

‎config/src/main/java/org/springframework/security/config/http/DefaultFilterChainValidator.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -126,11 +126,11 @@ private void checkAuthorizationFilters(List<SecurityFilterChain> chains) {
126126
}
127127
if (authorizationFilter != null && filterSecurityInterceptor != null) {
128128
this.logger.warn(
129-
"It is not recommended to use authorizeRequests in the configuration. Please only use authorizeHttpRequests");
129+
"It is not recommended to use authorizeRequests or FilterSecurityInterceptor in the configuration. Please only use authorizeHttpRequests");
130130
}
131131
if (filterSecurityInterceptor != null) {
132132
this.logger.warn(
133-
"Usage of authorizeRequests is deprecated. Please use authorizeHttpRequests in the configuration");
133+
"Usage of authorizeRequests and FilterSecurityInterceptor are deprecated. Please use authorizeHttpRequests in the configuration");
134134
}
135135
authorizationFilter = null;
136136
filterSecurityInterceptor = null;

‎config/src/main/kotlin/org/springframework/security/config/annotation/web/HttpSecurityDsl.kt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ import org.springframework.security.web.util.matcher.RequestMatcher
4040
* @Bean
4141
* fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
4242
* http {
43-
* authorizeRequests {
43+
* authorizeHttpRequests {
4444
* authorize("/public", permitAll)
4545
* authorize(anyRequest, authenticated)
4646
* }

‎config/src/test/java/org/springframework/security/config/annotation/issue50/SecurityConfig.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,7 @@ public class SecurityConfig {
5252
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
5353
// @formatter:off
5454
http
55-
.authorizeRequests((requests) -> requests
55+
.authorizeHttpRequests((requests) -> requests
5656
.requestMatchers(pathPattern("/*")).permitAll())
5757
.authenticationProvider(authenticationProvider());
5858
// @formatter:on

‎config/src/test/java/org/springframework/security/config/annotation/sec2758/Sec2758Tests.java

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,9 @@
3838
import org.springframework.security.test.context.annotation.SecurityTestExecutionListeners;
3939
import org.springframework.security.test.context.support.WithMockUser;
4040
import org.springframework.security.web.SecurityFilterChain;
41+
import org.springframework.security.web.access.expression.DefaultHttpSecurityExpressionHandler;
4142
import org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler;
43+
import org.springframework.security.web.access.expression.WebExpressionAuthorizationManager;
4244
import org.springframework.test.context.junit.jupiter.SpringExtension;
4345
import org.springframework.test.web.servlet.MockMvc;
4446
import org.springframework.web.bind.annotation.GetMapping;
@@ -84,11 +86,13 @@ public void methodSecurityWhenNullifyingRolePrefixThenPassivityRestored() {
8486
static class SecurityConfig {
8587

8688
@Bean
87-
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
89+
SecurityFilterChain filterChain(HttpSecurity http, WebExpressionAuthorizationManager.Builder authz)
90+
throws Exception {
8891
// @formatter:off
8992
http
90-
.authorizeRequests((requests) -> requests
91-
.anyRequest().access("hasAnyRole('CUSTOM')"));
93+
.authorizeHttpRequests((requests) -> requests
94+
.anyRequest().access(authz.expression("hasAnyRole('CUSTOM')"))
95+
);
9296
return http.build();
9397
// @formatter:on
9498
}
@@ -103,6 +107,16 @@ static DefaultRolesPrefixPostProcessor defaultRolesPrefixPostProcessor() {
103107
return new DefaultRolesPrefixPostProcessor();
104108
}
105109

110+
@Bean
111+
static WebExpressionAuthorizationManager.Builder authz(DefaultHttpSecurityExpressionHandler expressionHandler) {
112+
return WebExpressionAuthorizationManager.withExpressionHandler(expressionHandler);
113+
}
114+
115+
@Bean
116+
static DefaultHttpSecurityExpressionHandler expressionHandler() {
117+
return new DefaultHttpSecurityExpressionHandler();
118+
}
119+
106120
@RestController
107121
static class RootController {
108122

@@ -140,6 +154,9 @@ public Object postProcessAfterInitialization(Object bean, String beanName) throw
140154
if (bean instanceof DefaultWebSecurityExpressionHandler) {
141155
((DefaultWebSecurityExpressionHandler) bean).setDefaultRolePrefix(null);
142156
}
157+
if (bean instanceof DefaultHttpSecurityExpressionHandler http) {
158+
http.setDefaultRolePrefix("");
159+
}
143160
return bean;
144161
}
145162

‎config/src/test/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistryAnyMatcherTests.java

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ static class AntMatchersAfterAnyRequestConfig {
8585
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
8686
// @formatter:off
8787
http
88-
.authorizeRequests((requests) -> requests
88+
.authorizeHttpRequests((requests) -> requests
8989
.anyRequest().authenticated()
9090
.requestMatchers(pathPattern("/demo/**")).permitAll());
9191
return http.build();
@@ -102,7 +102,7 @@ static class MvcMatchersAfterAnyRequestConfig {
102102
SecurityFilterChain filterChain(HttpSecurity http, PathPatternRequestMatcher.Builder builder) throws Exception {
103103
// @formatter:off
104104
http
105-
.authorizeRequests((requests) -> requests
105+
.authorizeHttpRequests((requests) -> requests
106106
.anyRequest().authenticated()
107107
.requestMatchers(builder.matcher("/demo/**")).permitAll());
108108
return http.build();
@@ -119,7 +119,7 @@ static class RegexMatchersAfterAnyRequestConfig {
119119
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
120120
// @formatter:off
121121
http
122-
.authorizeRequests((requests) -> requests
122+
.authorizeHttpRequests((requests) -> requests
123123
.anyRequest().authenticated()
124124
.requestMatchers(new RegexRequestMatcher(".*", null)).permitAll());
125125
return http.build();
@@ -136,7 +136,7 @@ static class AnyRequestAfterItselfConfig {
136136
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
137137
// @formatter:off
138138
http
139-
.authorizeRequests((requests) -> requests
139+
.authorizeHttpRequests((requests) -> requests
140140
.anyRequest().authenticated()
141141
.anyRequest().permitAll());
142142
return http.build();
@@ -153,7 +153,7 @@ static class RequestMatchersAfterAnyRequestConfig {
153153
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
154154
// @formatter:off
155155
http
156-
.authorizeRequests((requests) -> requests
156+
.authorizeHttpRequests((requests) -> requests
157157
.anyRequest().authenticated()
158158
.requestMatchers(pathPattern("/**")).permitAll());
159159
return http.build();

‎config/src/test/java/org/springframework/security/config/annotation/web/builders/HttpConfigurationTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
152152
.securityMatchers((security) -> security
153153
.requestMatchers(pathPattern("/api/**"))
154154
.requestMatchers(pathPattern("/oauth/**")))
155-
.authorizeRequests((requests) -> requests
155+
.authorizeHttpRequests((requests) -> requests
156156
.anyRequest().hasRole("USER"))
157157
.httpBasic(withDefaults());
158158
return http.build();

‎config/src/test/java/org/springframework/security/config/annotation/web/builders/HttpSecurityAuthenticationManagerTests.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ static class AuthenticationManagerConfig {
8484
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
8585
// @formatter:off
8686
http
87-
.authorizeRequests((authz) -> authz
87+
.authorizeHttpRequests((authz) -> authz
8888
.anyRequest().authenticated()
8989
)
9090
.httpBasic(withDefaults())
@@ -106,7 +106,7 @@ static class AuthenticationManagerBuilderConfig {
106106
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
107107
// @formatter:off
108108
http
109-
.authorizeRequests((authz) -> authz
109+
.authorizeHttpRequests((authz) -> authz
110110
.anyRequest().authenticated()
111111
)
112112
.httpBasic(withDefaults())

0 commit comments

Comments
 (0)