Package org.springframework.security.config.annotation.web.configurers

# Class UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>

java.lang.Object
org.springframework.security.config.annotation.SecurityConfigurerAdapter<org.springframework.security.web.DefaultSecurityFilterChain,B>
org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer<C,H>
org.springframework.security.config.annotation.web.configurers.AbstractInterceptUrlConfigurer<UrlAuthorizationConfigurer<H>,H>
org.springframework.security.config.annotation.web.configurers.UrlAuthorizationConfigurer<H>

Type Parameters:
  `H` - the type of `HttpSecurityBuilder` that is being configured

All Implemented Interfaces:
  `SecurityConfigurer<org.springframework.security.web.DefaultSecurityFilterChain,H>`

@Deprecated public final class UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>> extends AbstractInterceptUrlConfigurer<UrlAuthorizationConfigurer<H>,H>
Deprecated.
Use `AuthorizeHttpRequestsConfigurer` instead
Adds URL based authorization using `DefaultFilterInvocationSecurityMetadataSource`. At least one `RequestMapping` needs to be mapped to `ConfigAttribute`'s for this `SecurityContextConfigurer` to have meaning.

## Security Filters

Usage includes applying the `UrlAuthorizationConfigurer` and then modifying the StandardInterceptUrlRegistry. For example:

     @Bean
     public SecurityFilterChain filterChain(HttpSecurity http, ApplicationContext context) throws Exception {
            http.apply(new UrlAuthorizationConfigurer<HttpSecurity>(context)).getRegistry()
                            .requestMatchers("/users**", "/sessions/**").hasRole("USER")
                            .requestMatchers("/signup").hasRole("ANONYMOUS").anyRequest().hasRole("USER");
     }

The following Filters are populated

- `FilterSecurityInterceptor`

## Shared Objects Created

The following shared objects are populated to allow other `SecurityConfigurer`'s to customize:

- `FilterSecurityInterceptor`

## Shared Objects Used

The following shared objects are used:

- AuthenticationManager

Since:
  3.2
See Also:
  - `ExpressionUrlAuthorizationConfigurer`

## Nested Class Summary

Nested Classes
Modifier and Type
Class
Description
`class`
`UrlAuthorizationConfigurer.AuthorizedUrl`
Deprecated.
Maps the specified `RequestMatcher` instances to `ConfigAttribute` instances.
`final class`
`UrlAuthorizationConfigurer.StandardInterceptUrlRegistry`
Deprecated.

## Nested classes/interfaces inherited from class org.springframework.security.config.annotation.web.configurers.AbstractInterceptUrlConfigurer

`AbstractInterceptUrlConfigurer.AbstractInterceptUrlRegistry<R extends AbstractInterceptUrlConfigurer<C,H>.AbstractInterceptUrlRegistry<R,T>,T>`

## Constructor Summary

Constructors
Constructor
Description
`UrlAuthorizationConfigurer(org.springframework.context.ApplicationContext context)`
Deprecated.

## Method Summary

Modifier and Type
Method
Description
`UrlAuthorizationConfigurer<H>.StandardInterceptUrlRegistry`
`getRegistry()`
Deprecated.
The StandardInterceptUrlRegistry is what users will interact with after applying the `UrlAuthorizationConfigurer`.
`UrlAuthorizationConfigurer<H>`
`withObjectPostProcessor(ObjectPostProcessor<?> objectPostProcessor)`
Deprecated, for removal: This API element is subject to removal in a future version.
`UrlAuthorizationConfigurer<H>`
`withObjectPostProcessor(ObjectPostProcessor<?> objectPostProcessor)`
Deprecated.
Adds an `ObjectPostProcessor` for this class.

### Methods inherited from class org.springframework.security.config.annotation.web.configurers.AbstractInterceptUrlConfigurer

`configure`

### Methods inherited from class org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer

`disable, getSecurityContextHolderStrategy`

### Methods inherited from class org.springframework.security.config.annotation.SecurityConfigurerAdapter

`addObjectPostProcessor, addObjectPostProcessor, and, getBuilder, init, postProcess, setBuilder`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Constructor Details

### UrlAuthorizationConfigurer

public UrlAuthorizationConfigurer(org.springframework.context.ApplicationContext context)
Deprecated.

## Method Details

### getRegistry

public UrlAuthorizationConfigurer<H>.StandardInterceptUrlRegistry getRegistry()
Deprecated.
The StandardInterceptUrlRegistry is what users will interact with after applying the `UrlAuthorizationConfigurer`.

Returns:
  the `ExpressionUrlAuthorizationConfigurer` for further customizations

### withObjectPostProcessor

public UrlAuthorizationConfigurer<H> withObjectPostProcessor(ObjectPostProcessor<?> objectPostProcessor)
Deprecated.
Adds an `ObjectPostProcessor` for this class.

Overrides:
  `withObjectPostProcessor` in class `AbstractHttpConfigurer<UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>,H extends HttpSecurityBuilder<H>>`
Parameters:
  `objectPostProcessor` -
Returns:
  the `UrlAuthorizationConfigurer` for further customizations

### withObjectPostProcessor

@Deprecated(since="6.4", forRemoval=true) public UrlAuthorizationConfigurer<H> withObjectPostProcessor(ObjectPostProcessor<?> objectPostProcessor)
Deprecated, for removal: This API element is subject to removal in a future version.

Overrides:
  `withObjectPostProcessor` in class `AbstractHttpConfigurer<UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>,H extends HttpSecurityBuilder<H>>`