Why authorization matters in Spring Boot

Introduction

Authorization controls what users can do in an app. It keeps private data safe and stops people from doing things they shouldn't.

When you want to limit access to certain pages or features based on user roles.

When you need to protect sensitive information like user profiles or payment details.

When different users have different permissions, like admins vs regular users.

When you want to prevent unauthorized changes to data.

When you want to log or track who accessed what in your app.

Syntax

Spring Boot

http.authorizeHttpRequests()
    .requestMatchers("/admin/**").hasRole("ADMIN")
    .requestMatchers("/user/**").hasAnyRole("USER", "ADMIN")
    .anyRequest().authenticated();

This example uses Spring Security to set rules for URL access.

Use hasRole for single roles and hasAnyRole for multiple roles.

Examples

Only users with the ADMIN role can access URLs starting with /admin/. Everyone else must be logged in.

Spring Boot

http.authorizeHttpRequests()
    .requestMatchers("/admin/**").hasRole("ADMIN")
    .anyRequest().authenticated();

Users must be logged in to see profile pages, but all other pages are open to everyone.

Spring Boot

http.authorizeHttpRequests()
    .requestMatchers("/profile/**").authenticated()
    .anyRequest().permitAll();

Sample Program

This Spring Boot security config sets authorization rules. Admin pages need ADMIN role. User pages need USER or ADMIN. All other pages require login. It also enables a login form.

Spring Boot

import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests()
            .requestMatchers("/admin/**").hasRole("ADMIN")
            .requestMatchers("/user/**").hasAnyRole("USER", "ADMIN")
            .anyRequest().authenticated()
            .and()
            .formLogin();
        return http.build();
    }
}

Important Notes

Authorization is different from authentication. Authentication checks who you are; authorization checks what you can do.

Always test your authorization rules to avoid accidental data leaks.

Summary

Authorization controls user access to app features and data.

Use Spring Security to set role-based access rules easily.

Proper authorization keeps your app safe and trustworthy.