Spring-security: Replacement for deprecated .shouldFilterAllDispatcherTypes(false)

50 Views Asked by At

In my application, I have a security config which includes:

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    // some code
    http.authorizeHttpRequests(customiser -> customiser
                    .shouldFilterAllDispatcherTypes(false)
                    .requestMatchers("/**")
                    .authenticated());
    // some code
    return http.build()

I need to specifically allow dispatcherTypes as I have a controller which returns ResponseEntity<StreamingResponseBody>. I assume that this means that DispatcherType.ASYNC needs to be allowed.

However, .shouldFilterAllDispatcherTypes(false) is deprecated for removal in spring-boot 3.2.2. The documentation suggests using .dispatcherTypeMatchers(DispatcherType... type) instead. However, when I attempt to introduce that method into my code, I am not able to specify .requestMatchers() in the method chain. I.e. this doesn't work:

            http.authorizeHttpRequests(customiser -> customiser
                    .dispatcherTypeMatchers(DispatcherType.values())
                    .requestMatchers("/**") // <-- the return value of dispatcherTypeMatchers doesn't have this method.
                    .authenticated());

How can I replace the code in the first block with something which isn't deprecated for removal?

0

There are 0 best solutions below