Dynamically defining access control to URLs

Spring Security provides several methods for mapping ConfigAttribute objects to a resource. For example, the antMatchers() method ensures it is simple for developers to restrict access to specific HTTP requests in their web application. Behind the scenes, an implementation of o.s.s.acess.SecurityMetadataSource is populated with these mappings and queried to determine what is required in order to be authorized to make any given HTTP request.

While the antMatchers() method is very simple, there may be times that it would be desirable to provide a custom mechanism for determining the URL mappings. An example of this might be if an application needs to be able to dynamically provide the access control rules. Let's demonstrate what it would take to move our URL authorization configuration into a database.

...