@@ -546,8 +546,10 @@ And even though xref:servlet/authentication/architecture.adoc#servlet-authentica
546546To address that, you can configure Spring Security Java configuration to allow dispatcher types like `FORWARD` and `ERROR`, like so:
547547
548548.Match by Dispatcher Type
549- ====
550- .Java
549+ [tabs]
550+ ======
551+ Java::
552+ +
551553[source,java,role="secondary"]
552554----
553555http
558560 )
559561----
560562
561- .Kotlin
563+ Kotlin::
564+ +
562565[source,kotlin,role="secondary"]
563566----
564567http {
@@ -570,7 +573,7 @@ http {
570573 }
571574}
572575----
573- ====
576+ ======
574577
575578[[match-by-mvc]]
576579=== Using an MvcRequestMatcher
@@ -584,8 +587,10 @@ For example, if Spring MVC is mapped to `/spring-mvc` instead of `/` (the defaul
584587You need to use `MvcRequestMatcher` to split the servlet path and the controller path in your configuration like so:
585588
586589.Match by MvcRequestMatcher
587- ====
588- .Java
590+ [tabs]
591+ ======
592+ Java::
593+ +
589594[source,java,role="primary"]
590595----
591596@Bean
@@ -605,7 +610,8 @@ SecurityFilterChain appEndpoints(HttpSecurity http, MvcRequestMatcher.Builder mv
605610}
606611----
607612
608- .Kotlin
613+ Kotlin::
614+ +
609615[source,kotlin,role="secondary"]
610616----
611617@Bean
@@ -622,15 +628,16 @@ fun appEndpoints(http: HttpSecurity, mvc: MvcRequestMatcher.Builder): SecurityFi
622628 }
623629----
624630
625- .Xml
631+ Xml::
632+ +
626633[source,xml,role="secondary"]
627634----
628635<http>
629636 <intercept-url servlet-path="/spring-mvc" pattern="/my/controller/**" access="hasAuthority('controller')"/>
630637 <intercept-url pattern="/**" access="authenticated"/>
631638</http>
632639----
633- ====
640+ ======
634641
635642This need can arise in at least two different ways:
636643
@@ -646,8 +653,10 @@ This feature is not currently supported in XML
646653In Java configuration, you can create your own javadoc:org.springframework.security.web.util.matcher.RequestMatcher[] and supply it to the DSL like so:
647654
648655.Authorize by Dispatcher Type
649- ====
650- .Java
656+ [tabs]
657+ ======
658+ Java::
659+ +
651660[source,java,role="secondary"]
652661----
653662RequestMatcher printview = (request) -> request.getParameter("print") != null;
658667 )
659668----
660669
661- .Kotlin
670+ Kotlin::
671+ +
662672[source,kotlin,role="secondary"]
663673----
664674val printview: RequestMatcher = { (request) -> request.getParameter("print") != null }
@@ -669,7 +679,7 @@ http {
669679 }
670680}
671681----
672- ====
682+ ======
673683
674684[TIP]
675685Because javadoc:org.springframework.security.web.util.matcher.RequestMatcher[] is a functional interface, you can supply it as a lambda in the DSL.
@@ -889,8 +899,10 @@ When you have static resources it can be tempting to configure the filter chain
889899A more secure approach is to permit them using `permitAll` like so:
890900
891901.Permit Static Resources
892- ====
893- .Java
902+ [tabs]
903+ ======
904+ Java::
905+ +
894906[source,java,role="secondary"]
895907----
896908http
900912 )
901913----
902914
903- .Kotlin
915+ Kotlin::
916+ +
904917[source,kotlin,role="secondary"]
905918----
906919http {
@@ -910,7 +923,7 @@ http {
910923 }
911924}
912925----
913- ====
926+ ======
914927
915928It's more secure because even with static resources it's important to write secure headers, which Spring Security cannot do if the request is ignored.
916929
0 commit comments