Configure Spring HTTP Security at Runtime

Question

All http protection is applied at startup:

protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() .antMatchers("/admin/**").hasRole("admin") } 

At runtime, I try to add even more to it ...

 applicationContext.getBean(WebSecurityConfigurerAdapter).http.authorizeRequests().antMatchers("bla").hasRole("admin") 

When this line is executed, it adds it to http.authorizeRequests (), but / bla is still accessible using "non admins"

When the server restarts, this change takes effect as it loads bla from the database.

How to make protection immediately effective without rebooting the server?

Answer 1

You are trying to dynamically change the spring bean at run time, which is very difficult to do if you are not using tools such as spring -loaded or JRebel. Much has been said about this:

• Update spring beans dynamically. Is it possible?
• dynamically change spring beans
• Is it possible to replace the definition of spring bean at runtime?

The best approach (in my opinion) for your use case is to use spring profiles.
Define a bean with permissions for / bla and another bean without. Then use them in different profiles.

see dynamically declare beans at run time in Spring