Difference between requestMatchers().mvcMatchers( and mvcMatcher(

Question

I know that requestMatchers specifies to which requests the security check applies but there is also mvcMatcher which is pretty similar. Can they be used interchangeably?

e.g.

    @Override
    public void configure(HttpSecurity httpSecurity) 
      httpSecurity.requestMatchers().mvcMatchers("/*")... 

vs

    @Override
    public void configure(HttpSecurity httpSecurity) 
      httpSecurity.mvcMatcher("/*")...

Answer 1

There is no big difference between those two methods. When you have a simple configuration with a single path, you can use mvcMatcher("/api/**") for example.

When a more advanced configuration is necessary, you can use requestMatchers(...) or requestMatcher(...), like so:

http
    .requestMatchers()
        .mvcMatchers("/api/**")
        .mvcMatchers("/admin/**")
        .requestMatchers(myCustomRequestMatcher())

If you look at the source code, the mvcMatchers() method call the requestMatcher() method:

public HttpSecurity mvcMatcher(String mvcPattern) {
    HandlerMappingIntrospector introspector = new HandlerMappingIntrospector(getContext());
    return requestMatcher(new MvcRequestMatcher(introspector, mvcPattern));
}