org.springframework.security.config.web.server.ServerHttpSecurity Java Examples

@Bean SecurityWebFilterChain springSecurityFilterChain(final ServerHttpSecurity http) {

    http
        .authorizeExchange()
          .pathMatchers("/favicon.ico", "/css/**", "/webjars/**")
            .permitAll()
          .anyExchange()
            .authenticated()
            .and()
        .httpBasic()
          .and()
        .formLogin()
          .and()
        .logout()
    ;

    return http.build();
  }
 

@Bean
public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http,
                                                     ServerAccessDeniedHandler accessDeniedHandler,
                                                     ServerAuthenticationEntryPoint authenticationEntryPoint) {
    return http
        .csrf()
        .accessDeniedHandler(accessDeniedHandler)
        .and()
        .exceptionHandling()
        .authenticationEntryPoint(authenticationEntryPoint)
        .accessDeniedHandler(accessDeniedHandler)
        .and()
        .authorizeExchange()
        .pathMatchers(GET, "/test/protected").authenticated()
        .pathMatchers(POST, "/test/protected").hasRole("ADMIN")
        .anyExchange().permitAll()
        .and().build();
}
 

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) throws Exception {
	http
		.csrf().disable()
		.authorizeExchange()
			.pathMatchers("/headerrouting/**").permitAll()
			.pathMatchers("/actuator/**").permitAll()
			.pathMatchers("/eureka/**").permitAll()
			.pathMatchers("/oauth/**").permitAll()
			.pathMatchers("/config/**").permitAll()
			.anyExchange().authenticated()
			.and()
		.oauth2ResourceServer()
			.jwt();
	return http.build();
}
 

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) throws Exception {
	http
		.csrf().disable()
		.authorizeExchange()
			.pathMatchers("/headerrouting/**").permitAll()
			.pathMatchers("/actuator/**").permitAll()
			.pathMatchers("/eureka/**").permitAll()
			.pathMatchers("/oauth/**").permitAll()
			.pathMatchers("/config/**").permitAll()
			.anyExchange().authenticated()
			.and()
		.oauth2ResourceServer()
			.jwt();
	return http.build();
}
 

@Bean
SecurityWebFilterChain authorization(ServerHttpSecurity http) {
	ReactiveAuthorizationManager<AuthorizationContext> auth =
			(authentication, object) -> Mono.just(new AuthorizationDecision(object.getVariables().get("name").equals("rwinch")));

	//@formatter:off
	return
			http
			.authorizeExchange()
				.pathMatchers("/greeting").authenticated()
				.pathMatchers("/hi/{name}").access(auth)
			.and()
				.csrf()
					.disable()
			.httpBasic()
			.and()
			.build();
	//@formatter:on
}
 

@Bean
public SecurityWebFilterChain securityWebFilterChain() {
	// the matcher for all paths that need to be secured (require a logged-in user)
	final ServerWebExchangeMatcher apiPathMatcher = pathMatchers(API_MATCHER_PATH);

	// default chain for all requests
	final ServerHttpSecurity http = this.context.getBean(ServerHttpSecurity.class);

	return http
		.authorizeExchange().matchers(apiPathMatcher).authenticated()
		.anyExchange().permitAll()
		.and().httpBasic().disable()
		.csrf().disable()
		.oauth2Client()
		.and()
		.oauth2Login()
		.and()
		.build();
}
 

@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http,
		ReactiveClientRegistrationRepository clientRegistrationRepository) {
	// Authenticate through configured OpenID Provider
	http.oauth2Login();
	// Also logout at the OpenID Connect provider
	http.logout(logout -> logout.logoutSuccessHandler(new OidcClientInitiatedServerLogoutSuccessHandler(
			clientRegistrationRepository)));
	// Require authentication for all requests
	http.authorizeExchange().anyExchange().authenticated();
	// Allow showing /home within a frame
	http.headers().frameOptions().mode(Mode.SAMEORIGIN);
	// Disable CSRF in the gateway to prevent conflicts with proxied service CSRF
	http.csrf().disable();
	return http.build();
}
 

@Bean
SecurityWebFilterChain authorization(ServerHttpSecurity http) {
	http.httpBasic();
	http.csrf().disable();
	http
		.authorizeExchange()
		.pathMatchers("/proxy").authenticated()
		.anyExchange().permitAll();
	return http.build();
}
 

@Bean
SecurityWebFilterChain authorization(ServerHttpSecurity http) {
		http.httpBasic();
		http.csrf().disable();
		http
			.authorizeExchange()
			.pathMatchers("/proxy").authenticated()
			.anyExchange().permitAll();
		return http.build();
}
 

@Bean
SecurityWebFilterChain authorization(ServerHttpSecurity security) {
		//@formatter:off
return
		security
		.csrf().disable()
		.httpBasic()
		.and()
		.authorizeExchange()
			.pathMatchers("/proxy").authenticated()
			.anyExchange().permitAll()
		.and()
		.build();
//@formatter:on
}
 

@Bean
SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) throws Exception {
    return http
        .authorizeExchange()
        .pathMatchers(HttpMethod.GET, "/posts/**").permitAll()
        .pathMatchers(HttpMethod.DELETE, "/posts/**").hasRole("ADMIN")
        .pathMatchers("/posts/**").authenticated()
        //.pathMatchers("/users/{user}/**").access(this::currentUserMatchesPath)
        .anyExchange().permitAll()
        .and()
        .build();
}
 

@Bean
SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) throws Exception {
    return http
            .csrf().disable()
            .authorizeExchange()
            .anyExchange().permitAll()
            .and()
            .build();
}
 

@Bean
SecurityWebFilterChain authorization(ServerHttpSecurity httpSecurity) {
	httpSecurity.httpBasic();
	httpSecurity.csrf().disable();
	httpSecurity
		.authorizeExchange()
		.pathMatchers("/proxy").authenticated()
		.anyExchange().permitAll();
	return httpSecurity.build();
}
 

@Bean
SecurityWebFilterChain authorization(ServerHttpSecurity http) {
	http.csrf().disable();
	http.httpBasic();
	http.authorizeExchange()
		.pathMatchers("/proxy").authenticated()
		.anyExchange().permitAll();
	return http.build();
}
 

@Bean
SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) throws Exception {
	return http
		.authorizeExchange()
			.pathMatchers(HttpMethod.GET, "/posts/**").permitAll()
               .pathMatchers(HttpMethod.DELETE, "/posts/**").hasRole("ADMIN")
			//.pathMatchers("/users/{user}/**").access(this::currentUserMatchesPath)
			.anyExchange().authenticated()
			.and()
		.build();
}
 

@Bean
SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) throws Exception {
    return http
        .authorizeExchange()
        .pathMatchers(HttpMethod.GET, "/posts/**").permitAll()
        .pathMatchers(HttpMethod.DELETE, "/posts/**").hasRole("ADMIN")
        //.pathMatchers("/users/{user}/**").access(this::currentUserMatchesPath)
        .anyExchange().authenticated()
        .and()
        .build();
}
 

@Bean
SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) throws Exception {
    return http
        .authorizeExchange()
        .pathMatchers(HttpMethod.GET, "/posts/**").permitAll()
        .pathMatchers(HttpMethod.DELETE, "/posts/**").hasRole("ADMIN")
        //.pathMatchers("/users/{user}/**").access(this::currentUserMatchesPath)
        .anyExchange().authenticated()
        .and()
        .build();
}
 

@Bean
SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) throws Exception {
	return http
		.authorizeExchange()
			.pathMatchers(HttpMethod.GET, "/posts/**").permitAll()
               .pathMatchers(HttpMethod.DELETE, "/posts/**").hasRole("ADMIN")
			//.pathMatchers("/users/{user}/**").access(this::currentUserMatchesPath)
			.anyExchange().authenticated()
			.and()
		.build();
}
 

@Bean
public SecurityWebFilterChain sseServerSpringSecurityFilterChain(ServerHttpSecurity http) {
    http.authorizeExchange()
        .anyExchange()
        .permitAll();
    return http.build();
}
 

@Bean
public SecurityWebFilterChain debuggingConsumerSpringSecurityFilterChain(ServerHttpSecurity http) {
    http.authorizeExchange()
        .anyExchange()
        .permitAll();
    http.csrf().disable();
    return http.build();
}
 

public static void forLogin(
        final ServerHttpSecurity http,
        final AMType amType,
        final ApplicationContext ctx) {

    ReactiveClientRegistrationRepository clientRegistrationRepository =
            ctx.getBean(ReactiveClientRegistrationRepository.class);

    ReactiveOAuth2AuthorizedClientService authorizedClientService =
            new InMemoryReactiveOAuth2AuthorizedClientService(clientRegistrationRepository);
    ServerOAuth2AuthorizedClientRepository authorizedClientRepository =
            new AuthenticatedPrincipalServerOAuth2AuthorizedClientRepository(authorizedClientService);

    OAuth2AuthorizationRequestRedirectWebFilter authRequestRedirectFilter =
            new OAuth2AuthorizationRequestRedirectWebFilter(clientRegistrationRepository);

    AuthenticationWebFilter authenticationFilter =
            new OAuth2LoginAuthenticationWebFilter(authenticationManager(amType), authorizedClientRepository);
    authenticationFilter.setRequiresAuthenticationMatcher(
            new PathPatternParserServerWebExchangeMatcher("/login/oauth2/code/{registrationId}"));
    authenticationFilter.setServerAuthenticationConverter(
            new ServerOAuth2AuthorizationCodeAuthenticationTokenConverter(clientRegistrationRepository));
    authenticationFilter.setAuthenticationSuccessHandler(new RedirectServerAuthenticationSuccessHandler());
    authenticationFilter.setAuthenticationFailureHandler((exchange, ex) -> Mono.error(ex));
    authenticationFilter.setSecurityContextRepository(new WebSessionServerSecurityContextRepository());

    MediaTypeServerWebExchangeMatcher htmlMatcher = new MediaTypeServerWebExchangeMatcher(MediaType.TEXT_HTML);
    htmlMatcher.setIgnoredMediaTypes(Collections.singleton(MediaType.ALL));
    ServerAuthenticationEntryPoint entrypoint =
            new RedirectServerAuthenticationEntryPoint("/oauth2/authorization/" + amType.name());
    http.exceptionHandling().authenticationEntryPoint(new DelegateEntry(htmlMatcher, entrypoint).getEntryPoint());

    http.addFilterAt(authRequestRedirectFilter, SecurityWebFiltersOrder.HTTP_BASIC);
    http.addFilterAt(authenticationFilter, SecurityWebFiltersOrder.AUTHENTICATION);
}
 

@Bean
@Primary
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	return http
				.authorizeExchange()
				.anyExchange().permitAll()
	            .and()
	            .formLogin()
				.and()
				.csrf().disable()
				.build();
}
 

@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
			.authorizeExchange()
			.anyExchange().permitAll()
			.and()
			.formLogin();
	return http.build();
}
 

@Bean
SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) throws Exception {
    return http
        .authorizeExchange()
        .pathMatchers(HttpMethod.GET, "/posts/**").permitAll()
        .pathMatchers(HttpMethod.DELETE, "/posts/**").hasRole("ADMIN")
        //.pathMatchers("/users/{user}/**").access(this::currentUserMatchesPath)
        .anyExchange().authenticated()
        .and()
        .build();
}
 

@Bean
public SecurityWebFilterChain staticContentSpringSecurityFilterChain(ServerHttpSecurity http) {
    http.authorizeExchange()
            .anyExchange()
            .permitAll();
    return http.build();
}
 

@Bean
public SecurityWebFilterChain securitygWebFilterChain(
        ServerHttpSecurity http) {
    return http.authorizeExchange()
            .anyExchange().authenticated().and().csrf().disable()
            .httpBasic()
            .and().build();
}
 

@Bean
SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) throws Exception {
    return http
            .csrf().disable()
            .authorizeExchange()
            .pathMatchers(HttpMethod.GET, "/posts/**").permitAll()
            .pathMatchers(HttpMethod.DELETE, "/posts/**").hasRole("ADMIN")
            //.pathMatchers("/users/{user}/**").access(this::currentUserMatchesPath)
            .anyExchange().authenticated()
            .and()
            .build();
}
 

@Bean
public SecurityWebFilterChain functionalValidationsSpringSecurityFilterChain(ServerHttpSecurity http) {
    http.authorizeExchange()
        .anyExchange()
        .permitAll();
    http.csrf().disable();
    return http.build();
}
 

@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
    http.authorizeExchange()
        .anyExchange()
        .authenticated()
        .and()
        .oauth2Client()
        .and()
        .formLogin();
    return http.build();
}
 

@Bean
   SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		.authorizeExchange()
			.pathMatchers("/actuator/**").permitAll()
			.pathMatchers(POST, "/product-composite/**").hasAuthority("SCOPE_product:write")
			.pathMatchers(DELETE, "/product-composite/**").hasAuthority("SCOPE_product:write")
			.pathMatchers(GET, "/product-composite/**").hasAuthority("SCOPE_product:read")
			.anyExchange().authenticated()
			.and()
		.oauth2ResourceServer()
			.jwt();
	return http.build();
}