Spring protection of several hasIPAddress antMatchers

Question

I have the following spring security configuration snippet:

http .authorizeRequests() .antMatchers("/tokens").hasIpAddress("10.0.0.0/16") .... 

This works, but I would also like to provide access to "/tokens" from 127.0.0.1 . I was hoping something like the following would work, but it is not:

 http .authorizeRequests() .antMatchers("/tokens").hasIpAddress("10.0.0.0/16").hasIpAddress("127.0.0.1/32") .... 

Answer 1

 http .authorizeRequests() .antMatchers("/tokens").access( "hasIpAddress('10.0.0.0/16') or hasIpAddress('127.0.0.1/32')") .... 

Answer 2

Try setting this configuration in a spring security configuration file like this

 <http auto-config="true" use-expressions="true"> <intercept-url pattern="/tokens**" access="hasIpAddress('10.0.0.0/16') or hasIpAddress('127.0.0.1/32')" /> </http>