Computer scienceBackendSpring BootSpring Security

Authorization

Correct implementation

Report a typo

There is a program with three endpoints:

GET /get available to everyone.
POST /add available only to authenticated users.
PUT /update only available to authenticated users with the ROLE_MANAGER role.

Select the appropriate code snippet that strictly enforces such access rules.

Java

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http
            .authorizeHttpRequests(matcherRegistry -> matcherRegistry
                    .requestMatchers("/get").permitAll()
                    .requestMatchers("/add").authenticated()
                    .requestMatchers("/update").hasAuthority("ROLE_MANAGER")
                    .anyRequest().denyAll()
            )
            .httpBasic(Customizer.withDefaults())
            .build();
}

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http
            .authorizeHttpRequests(matcherRegistry -> matcherRegistry
                    .requestMatchers(HttpMethod.GET, "/get").permitAll()
                    .requestMatchers(HttpMethod.POST, "/add").authenticated()
                    .requestMatchers(HttpMethod.PUT, "/update").hasAuthority("ROLE_MANAGER")
                    .anyRequest().denyAll()
            )
            .httpBasic(Customizer.withDefaults())
            .build();
}

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http
            .authorizeHttpRequests(matcherRegistry -> matcherRegistry
                    .requestMatchers(HttpMethod.GET, "/get").permitAll()
                    .requestMatchers(HttpMethod.POST, "/add").authenticated()
                    .requestMatchers(HttpMethod.PUT, "/update").hasAuthority("MANAGER")
                    .anyRequest().denyAll()
            )
            .httpBasic(Customizer.withDefaults())
            .build();
}

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http
            .authorizeHttpRequests(matcherRegistry -> matcherRegistry
                    .requestMatchers("/get").permitAll()
                    .requestMatchers("/add").authenticated()
                    .requestMatchers("/update").hasRole("MANAGER")
                    .anyRequest().denyAll()
            )
            .httpBasic(Customizer.withDefaults())
            .build();
}

Kotlin

@Bean
fun securityFilterChain(http: HttpSecurity): SecurityFilterChain =
    http
        .authorizeHttpRequests { matcherRegistry -> matcherRegistry
            .requestMatchers("/get").permitAll()
            .requestMatchers("/add").authenticated()
            .requestMatchers("/update").hasAuthority("ROLE_MANAGER")
            .anyRequest().denyAll()
        }
        .httpBasic(Customizer.withDefaults())
        .build()
}

@Bean
fun securityFilterChain(http: HttpSecurity): SecurityFilterChain =
    http
        .authorizeHttpRequests { matcherRegistry -> matcherRegistry
            .requestMatchers(HttpMethod.GET, "/get").permitAll()
            .requestMatchers(HttpMethod.POST, "/add").authenticated()
            .requestMatchers(HttpMethod.PUT, "/update").hasAuthority("ROLE_MANAGER")
            .anyRequest().denyAll()
        }
        .httpBasic(Customizer.withDefaults())
        .build()
}

@Bean
fun securityFilterChain(http: HttpSecurity): SecurityFilterChain =
    http
        .authorizeHttpRequests { matcherRegistry -> matcherRegistry
            .requestMatchers(HttpMethod.GET, "/get").permitAll()
            .requestMatchers(HttpMethod.POST, "/add").authenticated()
            .requestMatchers(HttpMethod.PUT, "/update").hasAuthority("MANAGER")
            .anyRequest().denyAll()
        }
        .httpBasic(Customizer.withDefaults())
        .build()
}

@Bean
fun securityFilterChain(http: HttpSecurity): SecurityFilterChain =
    http
        .authorizeHttpRequests { matcherRegistry -> matcherRegistry
            .requestMatchers("/get").permitAll()
            .requestMatchers("/add").authenticated()
            .requestMatchers("/update").hasRole("MANAGER")
            .anyRequest().denyAll()
        }
        .httpBasic(Customizer.withDefaults())
        .build()
}

Select one option from the list

___

Create a free account to access the full topic