Spring Starter OICD, Resource Server: Option to disable the default behavior for authorized/protected routes about spring-addons HOT 1 CLOSED

As a preamble, the default is not permitAll() / denyAll() but permitAll() / isAuthenticated().

I suggest that you define a path-prefix for shortened URLs. For instance, /u as path prefix and the permit-all=/u/** in conf, you'd keep the default behavior which protects your /admin/**, but also any other route that could be exposed by any starter added at any point in time (authors of which would probably expect the Spring Security default: isAuthenticated()). Sample frequently used starters exposing endpoints are actuator or springdoc-openapi.

If a path-prefix like /u is not acceptable, you can leave permit-all property empty and expose a @Bean implementing:

• ResourceServerHttpSecurityPostProcessor in a servlet resource server
• ClientHttpSecurityPostProcessor in a servlet client with oauth2Login
• ResourceServerAuthorizeExchangeSpecPostProcessor in a reactive servlet
• ClientAuthorizeExchangeSpecPostProcessor in a reactive client with oauth2Login

This allows to define the access control rules for everything that isn't defined as permit-all (default spring-addons-starter-oidc implementation is isAuthenticated(), just like spring-boot-starter-oauth2-client and spring-boot-starter-oauth2-resource-server do)

from spring-addons.