Spring Security: How to use multiple URL patterns

问题:

I have a bean

@Bean
public FilterRegistrationBean animalsFilterRegistration() {
    FilterRegistrationBean registration = new FilterRegistrationBean();
    registration.setFilter(new AnimalsFilter());
    registration.addUrlPatterns(
        "/api/cat",
        "/api/cat/**",
        "/api/dog"
    );
    ...
    return registration;
}

In that bean, I use two patterns for /api/cat** URLs. The problem is that when I try to call endpoints with complex postfix (/api/cat/1/feed), my filter does not intercept the request. But it's OK when I call /api/cat and /api/got endpoints -- filter works as expected and intercepts requests.

How can I use multiple URL patterns for my case (/api/cat, /api/cat/**)?

PS

I have tried to use next pattern combinations:

1) /api/cat, /api/cat**, /api/dog
2) /api/cat, /api/cat/**, /api/dog
3) /api/cat**, /api/dog

回答1:

As mentioned by @Tarun Lalwani, you need to use * instead of **, because ** is not a valid url pattern in this case.

In your case, try the following:

    registration.addUrlPatterns(
        "/api/cat",
        "/api/cat/*",
        "/api/dog",
        "/api/dog/*"
    );

those would match /api/cat/1, /api/cat/1/feed, /api/dog/1, /api/dog/1/feed, ...

If you want to replicate the /api/* behavior that would, only match /api/this but /api/not/that, then you need to use the following pattern: /api/*/.

回答2:

If you look at the documentation

https://docs.spring.io/spring-boot/docs/current-SNAPSHOT/api/org/springframework/boot/web/servlet/FilterRegistrationBean.html

When no URL pattern or servlets are specified the filter will be associated to '/*'

As you can see * is the pattern used by spring and not **. ** is usually a glob used by bash, golang. But spring uses * only. So what you need is just

registration.addUrlPatterns(
        "/api/cat",
        "/api/cat/*",
        "/api/dog",
        "/api/dog/*"
    );

The ** patterns are usually used in the security filters

https://docs.spring.io/spring-security/site/docs/current/reference/html/security-filter-chain.html#filter-chain-proxy

<bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">
<constructor-arg>
    <list>
    <sec:filter-chain pattern="/restful/**" filters="
        securityContextPersistenceFilterWithASCFalse,
        basicAuthenticationFilter,
        exceptionTranslationFilter,
        filterSecurityInterceptor" />
    <sec:filter-chain pattern="/**" filters="
        securityContextPersistenceFilterWithASCTrue,
        formLoginFilter,
        exceptionTranslationFilter,
        filterSecurityInterceptor" />
    </list>
</constructor-arg>
</bean>