title: Modify Spring Security Config at Runtime
body: <p>I am using the latest Spring Boot + Spring Boot Starter Security for a simple proxy application.  The goal is to launch the application with a single route/method:</p>
  
  <pre><code>@RequestMapping(value = "/api/register",
      method = RequestMethod.POST,
      produces = MediaType.APPLICATION_JSON_VALUE)
  @Timed
  public ResponseEntity&lt;?&gt; register(Registration registration) {
  </code></pre>
  
  <p>With a security configuration of:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      this.http = http
          .authorizeRequests()
          .antMatchers("/api/register").hasAuthority(AuthorityConstants.ADMIN)
      .and();
  }
  
  public HttpSecurity getHttpSecurity() {
      return http;
  }
  </code></pre>
  
  <p>The goal of the application would be to accept registration requests of the form:</p>
  
  <pre><code>{
      "route":"/api/foo/bar",
      "proxy_location": "http://back-end-server/path/to/resource",
      "role": "some-authority"
  }
  </code></pre>
  
  <p>And then the application would add an <code>/api/foo/bar</code> route with a pre-defined method that will proxy (forward) future requests to the backend service.  </p>
  
  <p>I know this is a little goofy, the real use-case involves websockets and dynamic creation of topics.</p>
  
  <p><strong>The issue I'm facing is that I cannot seem to update the security configuration after the SecurityConfigurer has completed.</strong></p>
  
  <p>In the code sample above I am caching the <code>HttpSecurity</code> object given to my <code>SecurityConfigurer</code> and then trying to use that object again to configure a new route:</p>
  
  <pre><code>@Inject
  private SecurityConfigurer security;
  
  @RequestMapping(value = "/api/register",
      method = RequestMethod.POST,
      produces = MediaType.APPLICATION_JSON_VALUE)
  @Timed
  public ResponseEntity&lt;?&gt; allowGetAccounts(Registration registration) {
      try {
          security.getHttpSecurity()
              .authorizeRequests()
              .antMatchers(registration.getRoute()).hasAuthority(registration.getRole());
  
          ...
  
      } catch (Exception e) {
          log.error("Updating security failed!", e);
      }
  
      return new ResponseEntity&lt;&gt;(null, HttpStatus.OK);
  }
  </code></pre>
  
  <p>Is there any way to update the security configuration dynamically during runtime?</p>
  
  <p>Also, if anyone has any notes on creating websocket topics dynamically that would be appreciated too!</p>