Authorizers: (v6.1)
Authorizers are meant to check authorizations to access an url (in the “security filter”):
- either on the authenticated user profile: has the user the appropriate role?
- or on the web context: can you call this resource in an iframe?
Notice that this concept of
Authorizer has a broader meaning than generally in the security field.Generally, authorizers are defined in the security configuration of the application.
Various authorizers are available:
- Roles/permissions - Anonymous/remember-me/(fully) authenticated - Profile type, attribute
- CORS - CSRF - Security headers - IP address, HTTP method
▸ Default authorizer names
Most pac4j implementations use pac4j logics and authorizers and thus the DefaultAuthorizationChecker component. In that case, the following Authorizer are automatically available via the following short names:
hstsfor theStrictTransportSecurityHeaderauthorizernosnifffor theXContentTypeOptionsHeaderauthorizernoframefor theXFrameOptionsHeaderauthorizerxssprotectionfor theXSSProtectionHeaderauthorizernocachefor theCacheControlHeaderauthorizersecurityheadersas a shortcut forhsts,nosniff,noframe,xssprotection,nocachecsrfTokenfor theCsrfTokenGeneratorAuthorizerauthorizercsrfCheckfor theCsrfAuthorizerauthorizercsrfas a shortcut forcsrfToken,csrfCheckisAnonymousfor theIsAnonymousAuthorizerauthorizerisAuthenticatedfor theIsAuthenticatedAuthorizerauthorizerisFullyAuthenticatedfor theIsFullyAuthenticatedAuthorizerauthorizerisRememberedfor theIsRememberedAuthorizerauthorizerallowAjaxRequestsfor a default configuration of theCorsAuthorizerauthorizer with theAccess-Control-Allow-Originheader set to*.
These short names are defined as constants in DefaultAuthorizers.