denyAll() Spring Security Expressions

In this article, we will explain how to Deny Access to All URLs and we can do it using denyAll() Spring Security Expressions. Spring’s Expression-Based Access Control has a denyAll expression which always evaluates to false. A sample code is given below of how to use this expression.

@Override
protected void configure(HttpSecurity http) throws Exception {
        http
        .authorizeHttpRequests()
        .anyRequest()
        .denyAll()
        .and()
        .httpBasic();
}

In the above code snippet the authorizeRequests() method is used to specify authorization rules for requests. In this case, anyRequest().denyAll() is used to deny access to all requests. This means that any URL will be inaccessible and will result in a 403 Forbidden response. With this configuration, all URLs will be denied access, and any request to your application will receive a 403 Forbidden response. Let’s understand the whole concept by developing a simple Spring MVC application.

Spring Security is a framework that allows a programmer to use JEE components to set security limitations on Spring-framework-based Web applications. In a nutshell, it’s a library that can be utilized and customized to suit the demands of the programmer. Because it is a part of the same Spring family as Spring Web MVC, it works well together. The most significant benefit of this framework is that it is both strong and very adaptable. Although it adheres to Spring’s set-up conventions, programmers may select between default provisions and modify them to their specific requirements. Read more on Spring Security and its Features in this article Introduction to Spring Security and its Features.