In Spring Security 6, the requestMatchers methods have replaced the deprecated antMatchers, mvcMatchers, and regexMatchers methods for configuring path-based access control. Here are the key points about the new requestMatchers:

Use requestMatchers in authorizeHttpRequests

The authorizeHttpRequests method in HttpSecurity configuration allows you to configure fine-grained request matching for access control. You can use the requestMatchers method to specify which requests should be permitted or authenticated. For example:

The Ultimate Guide for Java Developers Preparing for Technical Interviews

Java & Spring Boot Interview Prep Mastery BundleThe Ultimate Guide to Ace Your Next Technical Interview🚀 Boost Your Confidence, Land Your Dream Job!🔥 What’s Inside?1. 📖 100 Core Java Interview Questions✅ Master OOP, Multithreading, Collections, Exception Handling, and Java 8+ Features✅ Covers JVM Internals, Memory Management, and Performance Tuning✅ Real-World Examples & Best Practices2. 💻 50 Java Coding Problems✅ Arrays, Strings, Linked Lists, Trees, Dynamic Programming, and More!✅ Step-by-Step Explanations & Optimized Solutions✅ Commonly Asked in FAANG & Top Tech Companies3. 🌟 50 Spring Boot Interview Questions✅ Spring Boot Fundamentals, REST APIs, Spring Security, Microservices✅ Database Integration (JPA, Hibernate), Testing, and Deployment✅ Docker, Kubernetes, and Best Practices🎯 Who Is This For?✔ Java Developers preparing for technical interviews✔ Software Engineers targeting FAANG & top tech companies✔ Spring Boot Developers looking to deepen their knowledge✔ Students & Beginners wanting to crack coding interviews

codewithnik.gumroad.com

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http.authorizeHttpRequests(auth -> auth
        .requestMatchers("/greet").permitAll()
        .anyRequest().authenticated())
        .formLogin()
        .build();
}

This configuration permits access to the /greet endpoint without authentication while requiring authentication for all other requests.

requestMatchers vs securityMatchers

There are two similar methods: requestMatchers and securityMatchers. Both choose the most appropriate RequestMatcher implementation based on the presence of Spring MVC in the classpath:

• If Spring MVC is present, it uses MvcRequestMatcher
• If Spring MVC is not present, it falls back to AntPathRequestMatcher

The main difference is that securityMatchers is used in places like WebSecurityCustomizer, while requestMatchers is used in authorizeHttpRequests.

Choosing the Right Matcher

The requestMatchers methods allow you to match requests based on patterns or other criteria without relying on specific matchers like AntPathRequestMatcher or RegexRequestMatcher. This provides more flexibility and better defaults.

To use a specific matcher, you can pass a RequestMatcher implementation to the requestMatchers method:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http.authorizeHttpRequests(auth -> auth
        .requestMatchers(new AntPathRequestMatcher("/greet")).permitAll()
        .anyRequest().authenticated())
        .formLogin()
        .build();
}

In summary, the new requestMatchers methods in Spring Security 6 provide a more flexible and secure way to configure path-based access control, choosing the most appropriate RequestMatcher implementation based on the application's dependencies.