Namespace or URI based spring security

Question

I need to implement authorization based on namespace of the URI. For example, localhost:8080/common/* would be accessible to all kind of users and localhost:8080/admin/* would be accessible to only admin users.

I've already used UsernamePasswordAuthenticationFilter for login stuff but I don't know how to check for authorization for each request.

Can anybody guide me how to implement this kind of authorization with spring security?

Thanks & Regards.

score 0 · Answer 1 · edited May 23 '17 at 10:09

You can achieve this using the

<intercept-url> element

The intercept-url element can be used to define a pattern which is matched against the URLs of incoming requests using an ant path style syntax.

For example with Spring 3.0 + using SpEL:

<http auto-config="true" use-expressions="true">
    <intercept-url pattern="/common/*" access="permitAll" />
    <intercept-url pattern="/registered/*" access="hasAnyRole('ROLE_USER,ROLE_ADMIN')" />
    <intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')" />
</http>

If you don't have SpEL support then use like this:

<http auto-config='true'>
    <intercept-url pattern="/common/*" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
    <intercept-url pattern="/registered/*" access="ROLE_USER,ROLE_ADMIN" />
    <intercept-url pattern="/admin/*" access="ROLE_ADMIN" />
</http>

Documentation

Update - If you are doing forwards in your JSP/JSP, you need to set the once-per-request="false" on the http element.

Namespace or URI based spring security

1 Answers1