Search code examples
springspring-securityspring-restspring-oauth2

How to configure web security in spring security to allow some url to access?

How to configure WebSecurity in java based to allow some urls to be accessed. i tried as below

@Override
  protected void configure(HttpSecurity http) throws Exception {
    http
      .authorizeUrls()
        .antMatchers("/rest/**").permitAll().antMatchers("/admin/**").hasRole("ADMIN");            
  }

Here on above i want to allow "/rest/" **to all (it means this url should not be under security) and "/admin/**" should be secured and have authority of Admin. FYI i am using this with Spring oauth too so "/oauth/token" also should be accessible to all.

Solution

  • Try this to make all urls that you need open by admin scope:

    http.authorizeRequests()
        .antMatchers("/admin/**").access("hasRole('ADMIN')")

    I think you do not need to specify urls that are not have access permission in your configure method because they will be accessed normally.