Planned lessonJNR-036-L02

Configuring SecurityFilterChain

Lesson 2 of 8
Junior

On This Lesson 4 topics

In this lesson
Planned topics
Draft outline details
Practice

This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.

In this lesson

write request rules in a SecurityFilterChain bean.

Planned topics

Define a @Bean SecurityFilterChain that takes an HttpSecurity.
Use authorizeHttpRequests with requestMatchers(...) to say who may call what.
Rules are checked top to bottom; put specific rules first and anyRequest() last.
End with anyRequest().authenticated() or denyAll(), not permitAll().
For a stateless JSON API, you usually turn off sessions and form login; CSRF is covered in a later lecture.

Draft outline details

Demonstration

java

@Bean
SecurityFilterChain api(HttpSecurity http) throws Exception {
    http.authorizeHttpRequests(a -> a
        .requestMatchers(HttpMethod.GET, "/api/products/**").permitAll()
        .requestMatchers(HttpMethod.POST, "/api/products/**").hasRole("ADMIN")
        .anyRequest().authenticated())
      .httpBasic(Customizer.withDefaults());
    return http.build();
}

Check your understanding

Where must anyRequest() go?

Show answer

Last.

Practice

Apply this lesson with the module's lab, exercises and quiz.

Lab and exercises Quiz

Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.

Continue to next lesson