Spring Boot Security - Ant Matcher doesn't work - spring-boot

Question

I am trying to get familiar with spring boot security, my API is a simple GET/POST to 127.0.0.1:8080/employee/
with a simple autoconfiguration like this.
#Configuration
public class SecurityConfig implements WebMvcConfigurer {
#Configuration
protected static class ApplicationSecurity extends WebSecurityConfigurerAdapter{
#Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.inMemoryAuthentication()
.withUser("user1").password("{noop}user1").authorities("USER").and()
.withUser("user2").password("{noop}user2").authorities("USER").and()
.withUser("admin").password("{noop}admin").authorities("ADMIN");
}
#Override
protected void configure(HttpSecurity http) throws Exception {
http.antMatcher("/employee/**").authorizeRequests().anyRequest().hasRole("ADMIN");
}
}
}
This always gives me 403 Forbidden.
Have tried this:-
antMatcher("/employee*"), works but for any user. Can I get some help in understanding how this pattern works, I just need to restrict "/employee" or "/employee/" or "/employee/1" to Admin.

Answer 1

Your current configuration will only restrict any paths under employee e.g. employee/1 but not /employee. Additionally you are not doing anything with the employee matcher as you go back to authorizeRequests, then configure anyRequest has a role ADMIN
To restrict employee and any path underneath it to ADMIN.
http.authorizeRequests().antMatchers("/employee**", "/employee/**").hasRole("ADMIN").httpBasic();
Using ** will capture directories in path.
See
https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/util/AntPathMatcher.html
and
https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/web/util/matcher/AntPathRequestMatcher.html
Using a pattern value of /** or ** is treated as a universal match, which will match any request. Patterns which end with /** (and have no other wildcards) are optimized by using a substring match — a pattern of /aaa/** will match /aaa, /aaa/ and any sub-directories, such as /aaa/bbb/ccc.
I would also recommend testing your security configuration via the #WebMvcTest slice test
https://www.baeldung.com/spring-security-integration-tests
From the above a simple example would be,
#RunWith(SpringRunner.class)
#WebMvcTest(SecuredController.class)
public class SecuredControllerWebMvcIntegrationTest {
#Autowired
private MockMvc mvc;
// ... other methods
#WithMockUser(roles= {"admin"})
#Test
public void givenAuthRequestOnPrivateService_shouldSucceedWith200() throws Exception {
mvc.perform(get("/employee/1").contentType(MediaType.APPLICATION_JSON))
.andExpect(status().isOk());
}
//Repeated for other Paths
}