title: How to restrict routes in spring security dynamically?
body: <p>Good day,</p>
  
  <p>I am using spring security to restrict user, and i am using mongodb.</p>
  
  <p>I have created UserDetail and userDetail Services.</p>
  
  <p>her is my webSecurity config.</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
  
      @Bean
      public UserDetailsService mongoUserDetails() {
          return new CustomUserDetailsService();
      }
  
      @Bean
      public DaoAuthenticationProvider authProvider() {
          DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
          authProvider.setUserDetailsService(mongoUserDetails());
          authProvider.setPasswordEncoder(new BCryptPasswordEncoder());
          return authProvider;
      }
  
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          auth.authenticationProvider(authProvider());
      }
  
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .authorizeRequests()
                  .antMatchers("/", "/home", "/static/unsecure/**").permitAll()
                  .anyRequest().authenticated()
                  .and()
              .formLogin()
                  .loginPage("/login")
                  .permitAll()
                  .and()
              .logout()
                  .permitAll();
  
      }
  
  }
  </code></pre>
  
  <p>I am storing permissions in database like this.</p>
  
  <pre><code>"permissions" : [
      "/reports/report1", 
      "/reports/report2"
  ]
  </code></pre>
  
  <p>and here is userDetail service.</p>
  
  <pre><code>public class MongoUserDetails implements UserDetails {
  
      private final String username;
      private final String password;
      private final List&lt;GrantedAuthority&gt; grantedAuthorities;
      private final boolean enabled;
  
      public MongoUserDetails(String username, String password, String[] authorities, boolean isEnabled) {
          this.username = username;
          this.password = password;
          this.grantedAuthorities = AuthorityUtils.createAuthorityList(authorities);
          this.enabled = isEnabled;
      }
  
      @Override
      public Collection&lt;? extends GrantedAuthority&gt; getAuthorities() {
          return grantedAuthorities;
      }
  
      @Override
      public String getPassword() {
          return password;
      }
  
      @Override
      public String getUsername() {
          return username;
      }
  
      @Override
      public boolean isAccountNonExpired() {
          return true;
      }
  
      @Override
      public boolean isAccountNonLocked() {
          return true;
      }
  
      @Override
      public boolean isCredentialsNonExpired() {
          return true;
      }
  
      @Override
      public boolean isEnabled() {
          return enabled;
      }
  }
  </code></pre>
  
  <p>in private final List grantedAuthorities; I have successfully stored authorites. which are "/reports/report1", "/reports/report2" </p>
  
  <p>When i run my web application it is redirecting my to login page and after   valid credentials it redirects my to /hello page.</p>
  
  <p>Now i am creating controllers and actions like</p>
  
  <pre><code>@Controller
  @ResponseBody
  public class MyController {
  
      @GetMapping("/user/greeting")
      public String greeting(HttpServletRequest request){
          return "welcome secure";
      }
  
      @GetMapping("/login1")
      public String greeting1(HttpServletRequest request){
  
      }
  
  }
  </code></pre>
  
  <p>so since List grantedAuthorities; does not contains this route it should not allowed the user for this action</p>
  
  <p>how can i achieve this. assuming all authorities are dynamic.</p>
  
  <p>thanks. </p>