Menu
What is difference of HttpSecurity's antMatcher() and mvcMatcher() functions?
Could anyone explain when to use them ?
622
Generally mvcMatcher is more secure than an antMatcher . As an example: antMatchers("/secured") matches only the exact /secured URL. mvcMatchers("/secured") matches /secured as well as /secured/ , /secured.
The antMatchers() is a Springboot HTTP method used to configure the URL paths from which the Springboot application security should permit requests based on the user's roles. The antmatchers() method is an overloaded method that receives both the HTTP request methods and the specific URLs as its arguments.
Spring Security is probably the best choice for your cases. It became the de-facto choice in implementing the application-level security for Spring applications. Spring Security, however, doesn't automatically secure your application. It's not a kind of magic that guarantees a vulnerability-free app.
Spring Security is a powerful and highly customizable authentication and access-control framework. It is the de-facto standard for securing Spring-based applications. Spring Security is a framework that focuses on providing both authentication and authorization to Java applications.
As this methods' signatures clearly say is also stated in the official documentation -
antMatcher(String antPattern)- Allows configuring theHttpSecurityto only be invoked when matching the provided ant pattern.
mvcMatcher(String mvcPattern)- Allows configuring theHttpSecurityto only be invoked when matching the provided Spring MVC pattern.
Generally mvcMatcher is more secure than an antMatcher. As an example:
antMatchers("/secured") matches only the exact /secured URLmvcMatchers("/secured") matches /secured as well as /secured/, /secured.html, /secured.xyz and therefore is more general and can also handle some possible configuration mistakes.
mvcMatcher uses the same rules that Spring MVC uses for matching (when using @RequestMapping annotation).
If the current request will not be processed by Spring MVC, a reasonable default using the pattern as a ant pattern will be used. Source
It may be added that mvcMatchers API (since 4.1.1) is newer than the antMatchers API (since 3.1).
63
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
