Class ApiKeyConfigurer

java.lang.Object

com.codename1.backend.security.SecurityConfigurer

com.codename1.backend.security.ApiKeyConfigurer

public final class ApiKeyConfigurer
extends SecurityConfigurer

Sign-in with an API key on each request.

@Bean
SecurityFilterChain api(HttpSecurity http) {
    http.securityMatcher("/api/**")
        .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/deploy/**").hasAuthority("SCOPE_deploy")
                .anyRequest().authenticated())
        .apiKey(Customizer.withDefaults());
    return http.build();
}

A client sends its key as X-API-Key: cn1_... or as Authorization: Bearer cn1_.... Keys are looked up in the application's ApiKeyRepository bean unless repository names another, and are made with ApiKeyGenerator.

On a chain that also has oauth2ResourceServer(...), a bearer value that starts with the key prefix is an API key and any other is a token; that is the whole rule, and the reason the prefix here has to be the one the keys were generated with.

A request authenticated by its key is not asked for a CSRF token, and no session is started for it. A key's scopes are the authorities SCOPE_x.

Method Summary

Modifier and Type	Method	Description
ApiKeyConfigurer	authenticationEntryPoint(AuthenticationEntryPoint entryPoint)	What answers a request whose key is refused, and -- when this is the chain's only way in -- one that sent none.
void	configure(HttpSecurity http)	Adds this part's filters; nothing by default.
ApiKeyConfigurer	headerName(String headerName)	The header a key is sent in, beside Authorization: Bearer; X-API-Key unless set.
void	init(HttpSecurity http)	Shares what other parts need to know; nothing by default.
ApiKeyConfigurer	prefix(String prefix)	What every key starts with; cn1_ unless set.
ApiKeyConfigurer	repository(ApiKeyRepository repository)	Where keys are looked up, in place of the application's bean.

Methods inherited from class SecurityConfigurer

disable, getBuilder

Methods inherited from class Object

clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

repository

public ApiKeyConfigurer repository(ApiKeyRepository repository)

Where keys are looked up, in place of the application's bean.

prefix

public ApiKeyConfigurer prefix(String prefix)

What every key starts with; cn1_ unless set. It must be the prefix the keys were generated with.

headerName

public ApiKeyConfigurer headerName(String headerName)

The header a key is sent in, beside Authorization: Bearer; X-API-Key unless set.

authenticationEntryPoint

public ApiKeyConfigurer authenticationEntryPoint(AuthenticationEntryPoint entryPoint)

What answers a request whose key is refused, and -- when this is the chain's only way in -- one that sent none.

init

public void init(HttpSecurity http)

Description copied from class: SecurityConfigurer

Shares what other parts need to know; nothing by default.

Overrides:

init in class SecurityConfigurer

configure

public void configure(HttpSecurity http)

Description copied from class: SecurityConfigurer

Adds this part's filters; nothing by default.

Overrides:

configure in class SecurityConfigurer