1
1
2
2
[[kotlin-config]]
3
3
= Kotlin Configuration
4
+
4
5
Spring Security Kotlin configuration has been available since Spring Security 5.3.
5
6
It lets users configure Spring Security by using a native Kotlin DSL.
6
7
@@ -23,27 +24,27 @@ import org.springframework.security.config.annotation.web.invoke
23
24
24
25
@Bean
25
26
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
26
- http {
27
+ http {
27
28
authorizeHttpRequests {
28
29
authorize(anyRequest, authenticated)
29
30
}
30
- formLogin { }
31
- httpBasic { }
31
+ formLogin { }
32
+ httpBasic { }
32
33
}
33
34
return http.build()
34
35
}
35
36
----
36
37
37
38
[NOTE]
38
- Make sure that import the `invoke` function in your class, sometimes the IDE will not auto-import it causing compilation issues.
39
+ Make sure to import the `invoke` function in your class, as the IDE will not always auto-import the method, causing compilation issues.
39
40
40
41
The default configuration (shown in the preceding listing):
41
42
42
43
* Ensures that any request to our application requires the user to be authenticated
43
44
* Lets users authenticate with form-based login
44
45
* Lets users authenticate with HTTP Basic authentication
45
46
46
- Note that this configuration is parallels the XML namespace configuration:
47
+ Note that this configuration parallels the XML namespace configuration:
47
48
48
49
[source,xml]
49
50
----
@@ -58,13 +59,13 @@ Note that this configuration is parallels the XML namespace configuration:
58
59
59
60
We can configure multiple `HttpSecurity` instances, just as we can have multiple `<http>` blocks.
60
61
The key is to register multiple `SecurityFilterChain` ``@Bean``s.
61
- The following example has a different configuration for URL's that start with `/api/`:
62
+ The following example has a different configuration for URLs that start with `/api/`:
62
63
63
64
[source,kotlin]
64
65
----
65
- @Configuration
66
66
import org.springframework.security.config.annotation.web.invoke
67
67
68
+ @Configuration
68
69
@EnableWebSecurity
69
70
class MultiHttpSecurityConfig {
70
71
@Bean <1>
@@ -104,7 +105,7 @@ class MultiHttpSecurityConfig {
104
105
105
106
<1> Configure Authentication as usual.
106
107
<2> Create an instance of `SecurityFilterChain` that contains `@Order` to specify which `SecurityFilterChain` should be considered first.
107
- <3> The `http.antMatcher ` states that this `HttpSecurity` is applicable only to URLs that start with `/api/`
108
+ <3> The `http.securityMatcher ` states that this `HttpSecurity` is applicable only to URLs that start with `/api/`
108
109
<4> Create another instance of `SecurityFilterChain`.
109
110
If the URL does not start with `/api/`, this configuration is used.
110
111
This configuration is considered after `apiFilterChain`, since it has an `@Order` value after `1` (no `@Order` defaults to last).
0 commit comments