Package org.springframework.security.config.annotation.web.configurers

# Class AuthorizeHttpRequestsConfigurer.AuthorizedUrl

java.lang.Object
org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer.AuthorizedUrl

Enclosing class:
  AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>

public class AuthorizeHttpRequestsConfigurer.AuthorizedUrl extends Object
An object that allows configuring the `AuthorizationManager` for `RequestMatcher`s.

## Nested Class Summary

Nested Classes
Modifier and Type
Class
Description
`final class`
`AuthorizeHttpRequestsConfigurer.AuthorizedUrl.AuthorizedUrlVariable`
An object that allows configuring `RequestMatcher`s with URI path variables

## Method Summary

Modifier and Type
Method
Description
`AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry`
`access(org.springframework.security.authorization.AuthorizationManager<org.springframework.security.web.access.intercept.RequestAuthorizationContext> manager)`
Allows specifying a custom `AuthorizationManager`.
`AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry`
`anonymous()`
Specify that URLs are allowed by anonymous users.
`AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry`
`authenticated()`
Specify that URLs are allowed by any authenticated user.
`AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry`
`denyAll()`
Specify that URLs are not allowed by anyone.
`AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry`
`fullyAuthenticated()`
Specify that URLs are allowed by users who have authenticated and were not "remembered".
`protected List<? extends org.springframework.security.web.util.matcher.RequestMatcher>`
`getMatchers()`
`AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry`
`hasAnyAuthority(String... authorities)`
Specifies that a user requires one of many authorities.
`AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry`
`hasAnyRole(String... roles)`
Specifies that a user requires one of many roles.
`AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry`
`hasAuthority(String authority)`
Specifies a user requires an authority.
`AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry`
`hasRole(String role)`
Specifies a user requires a role.
`AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl.AuthorizedUrlVariable`
`hasVariable(String variable)`
Specify that a path variable in URL to be compared.
`AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl`
`not()`
Negates the following authorization rule.
`AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry`
`permitAll()`
Specify that URLs are allowed by anyone.
`AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry`
`rememberMe()`
Specify that URLs are allowed by users that have been remembered.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Method Details

### getMatchers

protected List<? extends org.springframework.security.web.util.matcher.RequestMatcher> getMatchers()

### not

public AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl not()
Negates the following authorization rule.

Returns:
  the `AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizedUrl` for further customization
Since:
  6.3

### permitAll

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry permitAll()
Specify that URLs are allowed by anyone.

Returns:
  the `AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry` for further customizations

### denyAll

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry denyAll()
Specify that URLs are not allowed by anyone.

Returns:
  the `AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry` for further customizations

### hasRole

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry hasRole(String role)
Specifies a user requires a role.

Parameters:
  `role` - the role that should be required which is prepended with ROLE_ automatically (i.e. USER, ADMIN, etc). It should not start with ROLE_
Returns:
  `AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry` for further customizations

### hasAnyRole

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry hasAnyRole(String... roles)
Specifies that a user requires one of many roles.

Parameters:
  `roles` - the roles that the user should have at least one of (i.e. ADMIN, USER, etc). Each role should not start with ROLE_ since it is automatically prepended already
Returns:
  the `AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry` for further customizations

### hasAuthority

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry hasAuthority(String authority)
Specifies a user requires an authority.

Parameters:
  `authority` - the authority that should be required
Returns:
  the `AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry` for further customizations

### hasAnyAuthority

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry hasAnyAuthority(String... authorities)
Specifies that a user requires one of many authorities.

Parameters:
  `authorities` - the authorities that the user should have at least one of (i.e. ROLE_USER, ROLE_ADMIN, etc)
Returns:
  the `AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry` for further customizations

### authenticated

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry authenticated()
Specify that URLs are allowed by any authenticated user.

Returns:
  the `AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry` for further customizations

### fullyAuthenticated

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry fullyAuthenticated()
Specify that URLs are allowed by users who have authenticated and were not "remembered".

Returns:
  the `AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry` for further customization
Since:
  5.8
See Also:
  - `RememberMeConfigurer`

### rememberMe

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry rememberMe()
Specify that URLs are allowed by users that have been remembered.

Returns:
  the `AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry` for further customization
Since:
  5.8
See Also:
  - `RememberMeConfigurer`

### anonymous

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry anonymous()
Specify that URLs are allowed by anonymous users.

Returns:
  the `AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry` for further customization
Since:
  5.8

### hasVariable

public AuthorizeHttpRequestsConfigurer<H>.AuthorizedUrl.AuthorizedUrlVariable hasVariable(String variable)
Specify that a path variable in URL to be compared.

For example,

     requestMatchers("/user/{username}").hasVariable("username").equalTo(Authentication::getName)

Parameters:
  `variable` - the variable in URL template to compare.
Returns:
  `AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizedUrl.AuthorizedUrlVariable` for further customization.
Since:
  6.3

### access

public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry access(org.springframework.security.authorization.AuthorizationManager<org.springframework.security.web.access.intercept.RequestAuthorizationContext> manager)
Allows specifying a custom `AuthorizationManager`.

Parameters:
  `manager` - the `AuthorizationManager` to use
Returns:
  the `AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>.AuthorizationManagerRequestMatcherRegistry` for further customizations