Spring-boot: Provide EndpointRequest for configuring WebFlux-based Security

[juergenzimmermann]

Using Spring Boot, SpringMVC and Spring Security I can configure the security part of my Spring Boot app as follows:

...requestMatchers(EndpointRequest.to("status", "info"))...

Now, I'm migrating from SpringMVC to Spring WebFlux. I see that I've to use pathMatchers() instead of requestMatchers from Spring Security. However, EndpointRequest is depending on HttpServletRequest (and thus on Spring MVC).
In https://stackoverflow.com/questions/47287312/spring-security-with-webflux-how-to-migrate-requestmatchersendpointrequest-to#comment-81531115 @bclozel suggests to open an issue.

[philwebb]

Indeed we'll need a ServerWebExchangeMatcher version and to probably rename EndpointRequest to EndpointServletRequest.

[mbhave]

See https://jira.spring.io/browse/SPR-16298

[philwebb]

Looks like SPR-16298 has been marked as resolved.

[philwebb]

I guess we're going to need to make a ServerWebExchangeMatcher for this so we can do something like:

public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
        return http.authorizeExchange().matchers(ReactiveEndpointRequest.to(...)

It's a bit annoying that we'll probably two different classes that virtually do the same thing. Perhaps we should introduce a servlet and reactive package and just use the same names.

[mbhave]

yeah, I'm not a fan of introducing ReactiveEndpointRequest and ServletEndpointRequest . Separate packages with the same name sounds better to me.

[snicoll]

Isn't that a bit dangerous if the contract is the same? You may end up importing the wrong class.

[mbhave]

I don't think it can be dangerous so to speak. Even if the name is the same, one gives you a RequestMatcher and the reactive on would provide a ServerWebExchangeMatcher.