0

The below setup allows anonymous user to access restricted antMatchers defined below. I tried placing /** at end of this chain and still not able to solve this. 

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
            .antMatchers("/**").permitAll()
            .and()
        .authorizeRequests()
            .antMatchers("/user/**").not().anonymous()
            .anyRequest().authenticated()
            .antMatchers("/user/**").not().anonymous()
            .anyRequest().authenticated()
            .antMatchers("/owner/**").access("hasRole('OWNER')")
            .anyRequest().authenticated()
            .antMatchers("/admin/**").access("hasRole('ADMIN')")
            .anyRequest().authenticated()
            .and()
        .formLogin()
            .loginPage("/login")
            .permitAll()
            .and()
        .logout()
            .permitAll();
  }

I wish a setup with authorization.

  1. /** for anonymous
  2. /admin for admin users
  3. /owner for owner users
  4. /user for other users

Authentication with specific roles are working fine.

Edit: If I give /browse/** to allow anonymous user, I can allow as I wish. But I don't want to see browse pattern in the URL as I am delivering pages through Spring MVC and makes me to move my pages to under /browse URL pattern.

How to deliver pages in Spring MVC for any user without any pattern match in the beginning of URL like browse or something? Can I use static and public folders under resources to deliver such pages? Good practice?

dur
  • 15,689
  • 25
  • 79
  • 125
Remigius
  • 107
  • 1
  • 1
  • 6
  • 1
    Possible duplicate of [How to fix role in Spring Security?](https://stackoverflow.com/questions/43052745/how-to-fix-role-in-spring-security) – dur Oct 15 '17 at 17:31
  • without mentioning any antmatcher, is there any way to allow all users other than /admin, /owner and /user ? I know we can put /public to all anonymous users to be allowed. I don't want to go with that. – Remigius Oct 26 '17 at 06:58

0 Answers0