When defining new spring boot REST resources, I tend to forget to also create a spring security configuration for their url patterns.
How can I, by default, deny access to all URLs, and only allow access to explicitly configured URL patterns? (I am using .hasRole
for to allow access) I want to avoid as many unintended security holes as possible.
Let's say I have three REST resources: /jobs
, /desks
and /salary
. My current code might look like this:
http.authorizeRequests()
.antMatchers(HttpMethod.GET, "/jobs")
.hasRole("my_user")
.antMatchers(HttpMethod.GET, "/desks")
.hasRole("my_user");
But currently, access to url /salary
is provided to everyone (because it is not yet configured)!
http.authorizeRequests().antMatchers("/admin/**") .access("hasRole('ADMIN')"
allows everything but everything following an admin url? Or maybehttp.authorizeRequests() .antMatchers("/admin*/**").authenticated() .anyRequest().permitAll() .and() .csrf().disable();
?