Snippet

Configuring Basic HTTP Endpoint Protection via SecurityFilterChain

Spring Security controls access to web routes through the SecurityFilterChain bean. In this configuration, endpoints under '/api/public/**' are publicly accessible without credentials, while all other requests require authentication via HTTP Basic Auth. Defining this bean establishes clear boundaries for API authorization.

snippet.java

java

@Configuration
@EnableWebSecurity
public class WebSecurityConfiguration {
 
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .httpBasic(Customizer.withDefaults());
        return http.build();
    }
}

spring

Breakdown

@Bean public SecurityFilterChain securityFilterChain(HttpSecurity http)

Declares the security filter chain bean used by Spring Security to inspect and authorize incoming requests.

.requestMatchers("/api/public/**").permitAll()

Allows unauthenticated access to all URL paths matching the '/api/public/**' pattern.

.anyRequest().authenticated()

Mandates that any request not explicitly permitted requires valid user authentication.

Previous snippet Next snippet

More Beginner Java exercises →

Configuring Basic HTTP Endpoint Protection via SecurityFilterChain

Related