Question

I have two patterns for which same filters are to be applied.

<security:filter-chain pattern="/home.do*" filters="a,b,c,d" />
<security:filter-chain pattern="/login.do*" filters="a,b,c,d" />

Along with the above two there are many other unique patterns and a generic pattern /**/*.do*/** as well.

Can I specify comma separated multiple patterns in the pattern attribute like below:

<security:filter-chain pattern="/home.do*, /login.do*" filters="a,b,c,d" />

Answer 1

Yes you can, but the implementation depends on Spring Security version you are using.

• In 3.0 you can use path-type attribute:

  <security:filter-chain-map path-type="regex">
    <security:filter-chain pattern="^/(test|home)\.do$" filters="a,b,c,d" />
    <!-- other patterns -->
  <security:filter-chain-map path-type="regex">
  

• In 3.1 you can either use request-matcher attribute (which deprecates path-type, just change path-type to request matcher in previous example), or you can use multiple http elements with request-matcher-ref bean and do this:

  <http pattern="test.do,home.do" security="none" <!-- 'none' as example -->
      request-matcher-ref="requestMatcher" />
  
  <bean id="requestMatcher" class="com.example.CommaSeparatedRequestMatcher" />
  

  with your custom implementation of CommaSeparatedRequestMatcher (which splits URL created from request and triest to match any string), based on, for example, RegexRequestMatcher.