Misleading documentation for websocket security

[tpianta]

Summary

The documentation uses the wrong wildcard in the example for allowing users to subscribe to '/user/' sockets.

Actual Behavior

The docs use a single '*' instead of '**' to wildcard:

https://docs.spring.io/spring-security/site/docs/current/reference/html/websocket.html#websocket-configuration

The java example is incorrect:

@Configuration public class WebSocketSecurityConfig extends AbstractSecurityWebSocketMessageBrokerConfigurer { protected void configureInbound(MessageSecurityMetadataSourceRegistry messages) { messages .simpDestMatchers("/user/*").authenticated() } }

Expected Behavior

The correct '**' wildcard is shown in the same docs in the xml example:

<websocket-message-broker> <intercept-message pattern="/user/**" access="hasRole('USER')" /> </websocket-message-broker>

Configuration

Version

Current

Sample