Portfolio


@Override
protected void configure(HttpSecurity http) throws Exception {
  http
      .authorizeRequests()
          .antMatchers("/spiiters/me").hasAuthority("ROLE_SPITTER")
          .antMatchers(HttpMethod.POST,".spittles").hasAuthority("ROLE_SPITTER")
          .anyRequest().permitAll();
}

해당 endpoint 에 ROLE_SPITTER 권한이 있어야 한다는 것


// requestMatchers 이용
web.ignoring()
        .requestMatchers(
                PathRequest.toStaticResources().atCommonLocations()
        );

// antMachers 이용
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
		http.cors()
			.and()
			.csrf().disable()
			.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER)
			.and()
			.authorizeRequests()
			.antMatchers("/accounts/login", "/admins/login", "/accounts/password/reset",
				"/admins/password/reset", "/admins/email/find", "/docs", "/health-check/ping").permitAll()
			.antMatchers(POST, "/accounts").permitAll()
			.antMatchers(GET, "/departments").hasRole("USER")
			.antMatchers("/inspections/**", "/organizations/**",
				"/departments/**", "/admins/**").hasRole("ADMIN")
			.antMatchers(POST, "/accounts/status").permitAll()
			.anyRequest().authenticated();

		http.addFilterBefore(jwtAuthenticationFilter(), HeaderWriterFilter.class);

		return http.build();
	}


http.authorizeRequests(
            request -> request
                .antMatchers(HttpMethod.POST, "/api/users/**").permitAll()
                .antMatchers(HttpMethod.GET, "/api/profiles/*").permitAll()
                .antMatchers(HttpMethod.GET, "/api/articles/*").permitAll()
                .anyRequest().hasRole("GUEST"))
// .anyRequest().access("hasRole('GUEST')")

위와 같이 hasRole로 “GUEST” 명시해주면 알아서 ROLE_GUEST로 체크를 하게 됨