Which strategy is correct for configuring Spring Security to intercept particular URLs? (Choose the best answer.)

Which strategy is correct for configuring Spring Security to intercept particular URLs? (Choose the best answer.)
A . The URLs can be specified via configuration (using authorizeRequests () and request matchers), with the most specific rule first and the least specific last.
B . Spring Security can obtain URLs from Spring MVC controllers, the Spring Security configuration just needs a reference to the controller to be protected.
C . The URLs are specified in a special properties file, used by Spring Security.
D . The URLs can be specified via configuration (using authorizeRequests () and request matchers), with the least specific rule first and the most specific last.

View Answer

Answer: A

Explanation:

Spring Security provides a fluent API for configuring web security based on URL patterns and request matchers. The authorizeRequests() method returns an expression that allows specifying access rules for different URLs using methods such as antMatchers(), regexMatchers(), mvcMatchers(), etc. The order of these rules matters, as they are evaluated from top to bottom. Therefore, it is recommended to put the most specific rules first and the least specific ones last.

Reference: https://www.baeldung.com/security-none-filters-none-access-permitAll