Spring security: share intercept-url between configuration

Question

I have two different configuration of spring security, one for local development and the other per test and production server. They are quite different but need to share the "intercept-url" part. Consither this:

<security:http ... >
    <security:http-basic />
    <security:anonymous />
    <security:intercept-url ... />
    <security:intercept-url ... />
    ...
</security:http>

I need to share the list of the intercept-url tags between two different http tags. Is there a way to do this?

Answer 1

That's not something you can easily do with the namespace.

If you are just defining access constraints, one possibility might be to define an external filter-security-metadata-source and write a BeanPostProcessor to inject it into the FilterSecurityInterceptor.

However, it's probably not worth the trouble for something like this.

Another option would be to externalize the authentication filters you want to use as beans (use the custom-filter element to add them to the <http> configuration) and configure them separately depending on your environment. It would be easier to suggest how feasible that is if you could post both configurations explicitly to see how much overlap there is.