Which strategy is correct for configuring Spring Security to intercept particular URLs? (Choose the best answer.)
Which strategy is correct for configuring Spring Security to intercept particular URLs? (Choose the best answer.)
The URLs can be specified via configuration (using authorizeRequests() and request matchers), with the most specific rule first and the least specific last. This is the correct way to configure Spring Security to intercept URLs to ensure that specific rules are evaluated before the more generic ones, thus avoiding incorrect rule application.
it is important that more specific patterns are defined higher in the list than less specific patterns
A=>most specific rule first and the least specific last.
Quote "A good practice is to define generic rules at the top and more specific rules at the bottom." at https://www.baeldung.com/spring-security-configuring-urls#1-allowing-requests-to-the-products-api