Allow language parameter in URL (Spring Boot / Security)

Question

Hello dear community,

---

details about my goal:

• Use internationalization in a Spring Boot application together with Spring Security's authentication mechanism
  • Using Baeldung's Guide to internationalization

---

the actual result:

• The internationalization works very well

---

then I added security:

http.authorizeRequests()

    // Restrict Endpoints
    .antMatchers("/login/**").hasAnyRole("admin", "member")

    // Allow Forms
    .antMatchers("/member/**").permitAll()

    // Allow Resources
    .antMatchers("/js/**").permitAll()
    .antMatchers("/css/**").permitAll()

    // Deny All
    .anyRequest().authenticated();
}

Due to .anyRequest().authenticated() a request on the root path like /?lang=de will trigger authentication.

---

what I tried:

http.authorizeRequests()

    // Restrict Endpoints
    .antMatchers("/login/**").hasAnyRole("admin", "member")

    // Allow Forms
    .antMatchers("/member/**").permitAll()

    // Allow Resources
    .antMatchers("/js/**").permitAll()
    .antMatchers("/css/**").permitAll()

    // Trick to allow Internationalization
    .antMatchers("/*").permitAll()

    // Deny All
    .anyRequest().authenticated();
}

I added .antMatchers("/*").permitAll() which works, but it allows to much resources on the root path. My goal is to only allow /?lang=de without authentication.

Is there any opportunity?

---

My resources I studied but not get confortable with:

• antMatchers Spring Security pattern with changeable URL user ID
• Regex doesn't match antMatcher URL pattern

---

Kind regards
OtenMoten

Answer 1

Well, finally it's working.

Above I told I was not confortable with the mentioned stackoverflow links, but yet it's working.

I've added:

.regexMatchers("/.*lang=.*").permitAll()

http.authorizeRequests()

// Restrict Endpoints
.antMatchers("/login/**").hasAnyRole("admin", "member")

// Allow Forms
.antMatchers("/member/**").permitAll()

// Allow Resources
.antMatchers("/js/**").permitAll()
.antMatchers("/css/**").permitAll()

.regexMatchers("/.*lang=.*").permitAll()

// Deny All
.anyRequest().authenticated();

}