Dynamically defining access control to URLs
Spring Security provides several methods for mapping ConfigAttribute objects to a resource. For example, the requestMatchers() method ensures it is simple for developers to restrict access to specific HTTP requests in their web applications. Behind the scenes, an implementation of o.s.s.acess.SecurityMetadataSource is populated with these mappings and queried to determine what is required in order to be authorized to make any given HTTP request.
While the requestMatchers() method is very simple, there may be times when it would be desirable to provide a custom mechanism for determining the URL mappings. An example of this might be if an application needs to be able to dynamically provide access control rules. Let’s demonstrate what it would take to move our URL authorization configuration into a database.
Configuring the RequestConfigMappingService
The first step is to be able to obtain the necessary information from the database...
