Whitelist endpoint in spring-webflux security without context root path - spring

Question

I am trying to whitelist all the custom endpoints which are ending with /health but in WebFlux Security I'm unable to use a regular expression to match all end-points. e.g. /app/health, /app/meta/health, /app/custom/meta/health, /api/app/custom/meta/health, etc. I'm not finding any pattern (or regex) to whitelist these end-points with one entry while constructing SecurityWebFilterChain.
Also I get a warning if I try to use regex
spring-security '**' patterns are not supported in the middle of patterns and will be rejected in the future. Consider using '*' instead for matching a single path segment.
Below is the code snippet
String[] ALLOWED_PATTERNS = {".*/health"};
// String[] ALLOWED_PATTERNS = {"/*/health"}; // allows whitelist /app/health endpoint
// String[] ALLOWED_PATTERNS = {"/*/health", "/*/*/health"}; // need generic way to whitelist all
#Bean
SecurityWebFilterChain springWebFilterChain(ServerHttpSecurity http) {
return http
.authorizeExchange()
.pathMatchers(ALLOWED_PATTERNS).permitAll()
.anyExchange().authenticated()
...
.build();
}
I could able to achieve the same in Spring Security (not reactive/web flux security) by providing antMatchers
#Override
public void configure(WebSecurity web) {
web.ignoring().antMatchers("/**/health");
}
Note: this is not a spring actuator health endpoint but a custom health endpoint

Answer 1

You can write your own matcher.
import com.google.common.cache.Cache;
import com.google.common.cache.CacheBuilder;
import lombok.extern.slf4j.Slf4j;
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
import org.springframework.web.server.ServerWebExchange;
import reactor.core.publisher.Mono;
import java.util.concurrent.ConcurrentMap;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
#Slf4j
public class RegexRequestMatcher {
private static final Cache<String, Pattern> CACHE = CacheBuilder.newBuilder().build();
private static final ConcurrentMap<String, Pattern> PATTERNS = CACHE.asMap();
public static Mono<ServerWebExchangeMatcher.MatchResult> matches(String regex, ServerWebExchange exchange) {
return matches(regex, exchange.getRequest().getURI().getPath());
}
public static Mono<ServerWebExchangeMatcher.MatchResult> matches(String regex, String uri) {
Pattern pattern = getPattern(regex);
Matcher matcher = pattern.matcher(uri);
boolean matches = matcher.matches();
return Mono.just(matches)
.flatMap(m -> m ? ServerWebExchangeMatcher.MatchResult.match() : ServerWebExchangeMatcher.MatchResult.notMatch());
}
private static Pattern getPattern(String regex) {
return PATTERNS.computeIfAbsent(regex, r -> Pattern.compile(r));
}
}
Then instead of pathMatchers you can use your own matcher.
.matchers(exchange -> RegexRequestMatcher.matches(".*/health", exchange)).permitAll()