0

How to configure WebSecurity in java based to allow some urls to be accessed. i tried as below

@Override
  protected void configure(HttpSecurity http) throws Exception {
    http
      .authorizeUrls()
        .antMatchers("/rest/**").permitAll().antMatchers("/admin/**").hasRole("ADMIN");            
  }

Here on above i want to allow "/rest/" **to all (it means this url should not be under security) and "/admin/**" should be secured and have authority of Admin. FYI i am using this with Spring oauth too so "/oauth/token" also should be accessible to all.

raju vaishnav
  • 751
  • 1
  • 6
  • 17

1 Answers1

0

Try this to make all urls that you need open by admin scope:

http.authorizeRequests()
        .antMatchers("/admin/**").access("hasRole('ADMIN')")

I think you do not need to specify urls that are not have access permission in your configure method because they will be accessed normally.

Júlio Dias
  • 92
  • 6