Simplify RequestMatcherDelegatingAuthorizationManager.Builder matcher registration #13110
Conversation
spring-projects-issues
added
the
status: waiting-for-triage
evgeniycheban
force-pushed
the
gh-11624
branch
4 times, most recently
from
dac9fd0 to
652b526
Compare
There was a problem hiding this comment.
Hi @evgeniycheban, I have left feedback inline.
Can you please ensure that the @since tags are updated to 6.2 because we already have a release candidate for 6.1?
| * @return the {@link AuthorizedUrl} for further customizations | ||
| * @since 6.1 | ||
| */ | ||
| public AuthorizedUrl requestMatchers(String... patterns) { |
There was a problem hiding this comment.
The requestMatchers method should keep the same behavior as AbstractRequestMatcherRegistry by creating a MvcRequestMatcher if possible and use AntPathRequestMatcher as a fallback.
There was a problem hiding this comment.
Hi @marcusdacoregio, thanks for the review. I'm not sure if it would be a good idea to propagate an ApplicationContext to this builder, maybe we could create here AntPathRequestMatcher by default
and let the user register MvcRequestMatcher using requestMatchers(RequestMatcher... matchers).
What do you think?
There was a problem hiding this comment.
I think you are right, can you make that behavior explicit in the javadoc?
There was a problem hiding this comment.
I've reflected this behavior in the javadoc and updated @since tags to 6.2.
There was a problem hiding this comment.
Hi @evgeniycheban, I am concerned about having the ant matcher the default if Spring MVC is in the classpath. This deviates from the default that Spring Security adopted in 6.0. For now, what if requestMatchers only takes a RequestMatcher instance? We can think more (in another issue) about how to communicate the MVC nuance to the builder.
There was a problem hiding this comment.
Hi @marcusdacoregio, makes sense, let's stay only with requestMatchers(RequestMatcher... matchers) for now and think about supporting MvcRequestMatcher in the future releases. I will update the PR soon.
There was a problem hiding this comment.
I've updated the PR.
marcusdacoregio
added
in: web
|
Thanks @evgeniycheban, this is now merged into |
Simplify RequestMatcherDelegatingAuthorizationManager.Builder matcher registration
Closes gh-11624