Welcome to OGeek Q&A Community for programmer and developer-Open, Learning and Share
Welcome To Ask or Share your Answers For Others

Categories

0 votes
1.6k views
in Technique[技术] by (71.8m points)

spring security http antMatcher with multiple paths

I have the following spring security java config rule (with version 3.2.4) which works:

http.antMatcher("/lti1p/**")
    .addFilterBefore(ltioAuthProviderProcessingFilter, UsernamePasswordAuthenticationFilter.class)
    .authorizeRequests().anyRequest().hasRole("LTI")
    .and().csrf().disable();

However, I would like to apply this rule to 2 paths ("/lti1p/" and ("/lti2p/"). I can't just replace antMatcher with antMatchers (HttpSecurity object doesn't allow it) and when I try something like this it doesn't apply the rule correctly anymore.

http
    .addFilterBefore(ltioAuthProviderProcessingFilter, UsernamePasswordAuthenticationFilter.class)
    .authorizeRequests()
    .antMatchers("/lti1p/**","/lti2p/**").hasRole("LTI")
    .and().csrf().disable();

I have tried a number of variants of this without any luck. Does anyone know the correct way to apply this rule using java config to multiple paths?

See Question&Answers more detail:os

与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
Welcome To Ask or Share your Answers For Others

1 Reply

0 votes
by (71.8m points)

Try the following approach:

http 
  .requestMatchers()
       .antMatchers("/lti1p/**","/lti2p/**")
       .and()
  .addFilterBefore(ltioAuthProviderProcessingFilter, UsernamePasswordAuthenticationFilter.class)
  .authorizeRequests().anyRequest().hasRole("LTI")
  .and().csrf().disable();

与恶龙缠斗过久,自身亦成为恶龙;凝视深渊过久,深渊将回以凝视…
OGeek|极客中国-欢迎来到极客的世界,一个免费开放的程序员编程交流平台!开放,进步,分享!让技术改变生活,让极客改变未来! Welcome to OGeek Q&A Community for programmer and developer-Open, Learning and Share
Click Here to Ask a Question

...