Skip to content

Commit 6d2727c

Browse files
jgrandjajgrandja
committed
Remove RequestMatcherUtils
Issue gh-2086 Closes gh-2144
1 parent 594bf1e commit 6d2727c

File tree

31 files changed

+136
-207
lines changed

31 files changed

+136
-207
lines changed

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2AuthorizationEndpointConfigurer.java‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -39,13 +39,13 @@
3939
import org.springframework.security.oauth2.server.authorization.web.OAuth2AuthorizationEndpointFilter;
4040
import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2AuthorizationCodeRequestAuthenticationConverter;
4141
import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2AuthorizationConsentAuthenticationConverter;
42-
import org.springframework.security.oauth2.server.authorization.web.util.matcher.RequestMatcherUtils;
4342
import org.springframework.security.web.authentication.AuthenticationConverter;
4443
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
4544
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
4645
import org.springframework.security.web.authentication.DelegatingAuthenticationConverter;
4746
import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;
4847
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
48+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
4949
import org.springframework.security.web.util.matcher.OrRequestMatcher;
5050
import org.springframework.security.web.util.matcher.RequestMatcher;
5151
import org.springframework.util.Assert;
@@ -238,11 +238,12 @@ void init(HttpSecurity httpSecurity) {
238238
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils
239239
.getAuthorizationServerSettings(httpSecurity);
240240
String authorizationEndpointUri = authorizationServerSettings.isMultipleIssuersAllowed()
241-
? RequestMatcherUtils.withMultipleIssuersPattern(authorizationServerSettings.getAuthorizationEndpoint())
241+
? OAuth2ConfigurerUtils
242+
.withMultipleIssuersPattern(authorizationServerSettings.getAuthorizationEndpoint())
242243
: authorizationServerSettings.getAuthorizationEndpoint();
243244
this.requestMatcher = new OrRequestMatcher(
244-
RequestMatcherUtils.matcher(authorizationEndpointUri, HttpMethod.GET),
245-
RequestMatcherUtils.matcher(authorizationEndpointUri, HttpMethod.POST));
245+
PathPatternRequestMatcher.withDefaults().matcher(HttpMethod.GET, authorizationEndpointUri),
246+
PathPatternRequestMatcher.withDefaults().matcher(HttpMethod.POST, authorizationEndpointUri));
246247
List<AuthenticationProvider> authenticationProviders = createDefaultAuthenticationProviders(httpSecurity);
247248
if (!this.authenticationProviders.isEmpty()) {
248249
authenticationProviders.addAll(0, this.authenticationProviders);
@@ -258,7 +259,8 @@ void configure(HttpSecurity httpSecurity) {
258259
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils
259260
.getAuthorizationServerSettings(httpSecurity);
260261
String authorizationEndpointUri = authorizationServerSettings.isMultipleIssuersAllowed()
261-
? RequestMatcherUtils.withMultipleIssuersPattern(authorizationServerSettings.getAuthorizationEndpoint())
262+
? OAuth2ConfigurerUtils
263+
.withMultipleIssuersPattern(authorizationServerSettings.getAuthorizationEndpoint())
262264
: authorizationServerSettings.getAuthorizationEndpoint();
263265
OAuth2AuthorizationEndpointFilter authorizationEndpointFilter = new OAuth2AuthorizationEndpointFilter(
264266
authenticationManager, authorizationEndpointUri);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2AuthorizationServerConfigurer.java‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,10 +50,10 @@
5050
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
5151
import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenGenerator;
5252
import org.springframework.security.oauth2.server.authorization.web.NimbusJwkSetEndpointFilter;
53-
import org.springframework.security.oauth2.server.authorization.web.util.matcher.RequestMatcherUtils;
5453
import org.springframework.security.web.authentication.HttpStatusEntryPoint;
5554
import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;
5655
import org.springframework.security.web.context.SecurityContextHolderFilter;
56+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
5757
import org.springframework.security.web.util.matcher.OrRequestMatcher;
5858
import org.springframework.security.web.util.matcher.RequestMatcher;
5959
import org.springframework.util.Assert;
@@ -368,9 +368,9 @@ public void init(HttpSecurity httpSecurity) throws Exception {
368368
requestMatchers.add(configurer.getRequestMatcher());
369369
});
370370
String jwkSetEndpointUri = authorizationServerSettings.isMultipleIssuersAllowed()
371-
? RequestMatcherUtils.withMultipleIssuersPattern(authorizationServerSettings.getJwkSetEndpoint())
371+
? OAuth2ConfigurerUtils.withMultipleIssuersPattern(authorizationServerSettings.getJwkSetEndpoint())
372372
: authorizationServerSettings.getJwkSetEndpoint();
373-
requestMatchers.add(RequestMatcherUtils.matcher(jwkSetEndpointUri, HttpMethod.GET));
373+
requestMatchers.add(PathPatternRequestMatcher.withDefaults().matcher(HttpMethod.GET, jwkSetEndpointUri));
374374
this.endpointsMatcher = new OrRequestMatcher(requestMatchers);
375375

376376
ExceptionHandlingConfigurer<HttpSecurity> exceptionHandling = httpSecurity
@@ -419,7 +419,7 @@ public void configure(HttpSecurity httpSecurity) {
419419
JWKSource<com.nimbusds.jose.proc.SecurityContext> jwkSource = OAuth2ConfigurerUtils.getJwkSource(httpSecurity);
420420
if (jwkSource != null) {
421421
String jwkSetEndpointUri = authorizationServerSettings.isMultipleIssuersAllowed()
422-
? RequestMatcherUtils.withMultipleIssuersPattern(authorizationServerSettings.getJwkSetEndpoint())
422+
? OAuth2ConfigurerUtils.withMultipleIssuersPattern(authorizationServerSettings.getJwkSetEndpoint())
423423
: authorizationServerSettings.getJwkSetEndpoint();
424424
NimbusJwkSetEndpointFilter jwkSetEndpointFilter = new NimbusJwkSetEndpointFilter(jwkSource,
425425
jwkSetEndpointUri);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2AuthorizationServerMetadataEndpointConfigurer.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@
2323
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationServerMetadata;
2424
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
2525
import org.springframework.security.oauth2.server.authorization.web.OAuth2AuthorizationServerMetadataEndpointFilter;
26-
import org.springframework.security.oauth2.server.authorization.web.util.matcher.RequestMatcherUtils;
2726
import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;
27+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
2828
import org.springframework.security.web.util.matcher.RequestMatcher;
2929

3030
/**
@@ -79,7 +79,8 @@ void init(HttpSecurity httpSecurity) {
7979
.getAuthorizationServerSettings(httpSecurity);
8080
String authorizationServerMetadataEndpointUri = authorizationServerSettings.isMultipleIssuersAllowed()
8181
? "/.well-known/oauth-authorization-server/**" : "/.well-known/oauth-authorization-server";
82-
this.requestMatcher = RequestMatcherUtils.matcher(authorizationServerMetadataEndpointUri, HttpMethod.GET);
82+
this.requestMatcher = PathPatternRequestMatcher.withDefaults()
83+
.matcher(HttpMethod.GET, authorizationServerMetadataEndpointUri);
8384
}
8485

8586
@Override

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2ClientAuthenticationConfigurer.java‎

Lines changed: 13 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -43,12 +43,12 @@
4343
import org.springframework.security.oauth2.server.authorization.web.authentication.JwtClientAssertionAuthenticationConverter;
4444
import org.springframework.security.oauth2.server.authorization.web.authentication.PublicClientAuthenticationConverter;
4545
import org.springframework.security.oauth2.server.authorization.web.authentication.X509ClientCertificateAuthenticationConverter;
46-
import org.springframework.security.oauth2.server.authorization.web.util.matcher.RequestMatcherUtils;
4746
import org.springframework.security.web.authentication.AuthenticationConverter;
4847
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
4948
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
5049
import org.springframework.security.web.authentication.DelegatingAuthenticationConverter;
5150
import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;
51+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
5252
import org.springframework.security.web.util.matcher.OrRequestMatcher;
5353
import org.springframework.security.web.util.matcher.RequestMatcher;
5454
import org.springframework.util.Assert;
@@ -182,29 +182,31 @@ void init(HttpSecurity httpSecurity) {
182182
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils
183183
.getAuthorizationServerSettings(httpSecurity);
184184
String tokenEndpointUri = authorizationServerSettings.isMultipleIssuersAllowed()
185-
? RequestMatcherUtils.withMultipleIssuersPattern(authorizationServerSettings.getTokenEndpoint())
185+
? OAuth2ConfigurerUtils.withMultipleIssuersPattern(authorizationServerSettings.getTokenEndpoint())
186186
: authorizationServerSettings.getTokenEndpoint();
187187
String tokenIntrospectionEndpointUri = authorizationServerSettings.isMultipleIssuersAllowed()
188-
? RequestMatcherUtils
188+
? OAuth2ConfigurerUtils
189189
.withMultipleIssuersPattern(authorizationServerSettings.getTokenIntrospectionEndpoint())
190190
: authorizationServerSettings.getTokenIntrospectionEndpoint();
191191
String tokenRevocationEndpointUri = authorizationServerSettings.isMultipleIssuersAllowed()
192-
? RequestMatcherUtils
192+
? OAuth2ConfigurerUtils
193193
.withMultipleIssuersPattern(authorizationServerSettings.getTokenRevocationEndpoint())
194194
: authorizationServerSettings.getTokenRevocationEndpoint();
195195
String deviceAuthorizationEndpointUri = authorizationServerSettings.isMultipleIssuersAllowed()
196-
? RequestMatcherUtils
196+
? OAuth2ConfigurerUtils
197197
.withMultipleIssuersPattern(authorizationServerSettings.getDeviceAuthorizationEndpoint())
198198
: authorizationServerSettings.getDeviceAuthorizationEndpoint();
199199
String pushedAuthorizationRequestEndpointUri = authorizationServerSettings.isMultipleIssuersAllowed()
200-
? RequestMatcherUtils
200+
? OAuth2ConfigurerUtils
201201
.withMultipleIssuersPattern(authorizationServerSettings.getPushedAuthorizationRequestEndpoint())
202202
: authorizationServerSettings.getPushedAuthorizationRequestEndpoint();
203-
this.requestMatcher = new OrRequestMatcher(RequestMatcherUtils.matcher(tokenEndpointUri, HttpMethod.POST),
204-
RequestMatcherUtils.matcher(tokenIntrospectionEndpointUri, HttpMethod.POST),
205-
RequestMatcherUtils.matcher(tokenRevocationEndpointUri, HttpMethod.POST),
206-
RequestMatcherUtils.matcher(deviceAuthorizationEndpointUri, HttpMethod.POST),
207-
RequestMatcherUtils.matcher(pushedAuthorizationRequestEndpointUri, HttpMethod.POST));
203+
this.requestMatcher = new OrRequestMatcher(
204+
PathPatternRequestMatcher.withDefaults().matcher(HttpMethod.POST, tokenEndpointUri),
205+
PathPatternRequestMatcher.withDefaults().matcher(HttpMethod.POST, tokenIntrospectionEndpointUri),
206+
PathPatternRequestMatcher.withDefaults().matcher(HttpMethod.POST, tokenRevocationEndpointUri),
207+
PathPatternRequestMatcher.withDefaults().matcher(HttpMethod.POST, deviceAuthorizationEndpointUri),
208+
PathPatternRequestMatcher.withDefaults()
209+
.matcher(HttpMethod.POST, pushedAuthorizationRequestEndpointUri));
208210
List<AuthenticationProvider> authenticationProviders = createDefaultAuthenticationProviders(httpSecurity);
209211
if (!this.authenticationProviders.isEmpty()) {
210212
authenticationProviders.addAll(0, this.authenticationProviders);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2ConfigurerUtils.java‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2020-2025 the original author or authors.
2+
* Copyright 2020-2024 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -43,6 +43,7 @@
4343
import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenClaimsContext;
4444
import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenCustomizer;
4545
import org.springframework.security.oauth2.server.authorization.token.OAuth2TokenGenerator;
46+
import org.springframework.util.Assert;
4647
import org.springframework.util.StringUtils;
4748

4849
/**
@@ -56,6 +57,11 @@ final class OAuth2ConfigurerUtils {
5657
private OAuth2ConfigurerUtils() {
5758
}
5859

60+
static String withMultipleIssuersPattern(String endpointUri) {
61+
Assert.hasText(endpointUri, "endpointUri cannot be empty");
62+
return endpointUri.startsWith("/") ? "/**" + endpointUri : "/**/" + endpointUri;
63+
}
64+
5965
static RegisteredClientRepository getRegisteredClientRepository(HttpSecurity httpSecurity) {
6066
RegisteredClientRepository registeredClientRepository = httpSecurity
6167
.getSharedObject(RegisteredClientRepository.class);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2DeviceAuthorizationEndpointConfigurer.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -35,12 +35,12 @@
3535
import org.springframework.security.oauth2.server.authorization.settings.AuthorizationServerSettings;
3636
import org.springframework.security.oauth2.server.authorization.web.OAuth2DeviceAuthorizationEndpointFilter;
3737
import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2DeviceAuthorizationRequestAuthenticationConverter;
38-
import org.springframework.security.oauth2.server.authorization.web.util.matcher.RequestMatcherUtils;
3938
import org.springframework.security.web.access.intercept.AuthorizationFilter;
4039
import org.springframework.security.web.authentication.AuthenticationConverter;
4140
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
4241
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
4342
import org.springframework.security.web.authentication.DelegatingAuthenticationConverter;
43+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
4444
import org.springframework.security.web.util.matcher.RequestMatcher;
4545
import org.springframework.util.Assert;
4646
import org.springframework.util.StringUtils;
@@ -199,10 +199,11 @@ public void init(HttpSecurity builder) {
199199
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils
200200
.getAuthorizationServerSettings(builder);
201201
String deviceAuthorizationEndpointUri = authorizationServerSettings.isMultipleIssuersAllowed()
202-
? RequestMatcherUtils
202+
? OAuth2ConfigurerUtils
203203
.withMultipleIssuersPattern(authorizationServerSettings.getDeviceAuthorizationEndpoint())
204204
: authorizationServerSettings.getDeviceAuthorizationEndpoint();
205-
this.requestMatcher = RequestMatcherUtils.matcher(deviceAuthorizationEndpointUri, HttpMethod.POST);
205+
this.requestMatcher = PathPatternRequestMatcher.withDefaults()
206+
.matcher(HttpMethod.POST, deviceAuthorizationEndpointUri);
206207

207208
List<AuthenticationProvider> authenticationProviders = createDefaultAuthenticationProviders(builder);
208209
if (!this.authenticationProviders.isEmpty()) {
@@ -220,7 +221,7 @@ public void configure(HttpSecurity builder) {
220221
.getAuthorizationServerSettings(builder);
221222

222223
String deviceAuthorizationEndpointUri = authorizationServerSettings.isMultipleIssuersAllowed()
223-
? RequestMatcherUtils
224+
? OAuth2ConfigurerUtils
224225
.withMultipleIssuersPattern(authorizationServerSettings.getDeviceAuthorizationEndpoint())
225226
: authorizationServerSettings.getDeviceAuthorizationEndpoint();
226227
OAuth2DeviceAuthorizationEndpointFilter deviceAuthorizationEndpointFilter = new OAuth2DeviceAuthorizationEndpointFilter(

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2DeviceVerificationEndpointConfigurer.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -39,12 +39,12 @@
3939
import org.springframework.security.oauth2.server.authorization.web.OAuth2DeviceVerificationEndpointFilter;
4040
import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2DeviceAuthorizationConsentAuthenticationConverter;
4141
import org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2DeviceVerificationAuthenticationConverter;
42-
import org.springframework.security.oauth2.server.authorization.web.util.matcher.RequestMatcherUtils;
4342
import org.springframework.security.web.authentication.AuthenticationConverter;
4443
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
4544
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
4645
import org.springframework.security.web.authentication.DelegatingAuthenticationConverter;
4746
import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;
47+
import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher;
4848
import org.springframework.security.web.util.matcher.OrRequestMatcher;
4949
import org.springframework.security.web.util.matcher.RequestMatcher;
5050
import org.springframework.util.Assert;
@@ -234,12 +234,12 @@ public void init(HttpSecurity builder) {
234234
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils
235235
.getAuthorizationServerSettings(builder);
236236
String deviceVerificationEndpointUri = authorizationServerSettings.isMultipleIssuersAllowed()
237-
? RequestMatcherUtils
237+
? OAuth2ConfigurerUtils
238238
.withMultipleIssuersPattern(authorizationServerSettings.getDeviceVerificationEndpoint())
239239
: authorizationServerSettings.getDeviceVerificationEndpoint();
240240
this.requestMatcher = new OrRequestMatcher(
241-
RequestMatcherUtils.matcher(deviceVerificationEndpointUri, HttpMethod.GET),
242-
RequestMatcherUtils.matcher(deviceVerificationEndpointUri, HttpMethod.POST));
241+
PathPatternRequestMatcher.withDefaults().matcher(HttpMethod.GET, deviceVerificationEndpointUri),
242+
PathPatternRequestMatcher.withDefaults().matcher(HttpMethod.POST, deviceVerificationEndpointUri));
243243

244244
List<AuthenticationProvider> authenticationProviders = createDefaultAuthenticationProviders(builder);
245245
if (!this.authenticationProviders.isEmpty()) {
@@ -257,7 +257,7 @@ public void configure(HttpSecurity builder) {
257257
.getAuthorizationServerSettings(builder);
258258

259259
String deviceVerificationEndpointUri = authorizationServerSettings.isMultipleIssuersAllowed()
260-
? RequestMatcherUtils
260+
? OAuth2ConfigurerUtils
261261
.withMultipleIssuersPattern(authorizationServerSettings.getDeviceVerificationEndpoint())
262262
: authorizationServerSettings.getDeviceVerificationEndpoint();
263263
OAuth2DeviceVerificationEndpointFilter deviceVerificationEndpointFilter = new OAuth2DeviceVerificationEndpointFilter(

0 commit comments

Comments
 (0)