Spring Security Java Config - dynamic IP list for a Request URL
<p>I have two configuration. The first would like to achieve that all requests from(/api/**) must come only from a determined ip.</p>

<p>like Following...</p>

<pre><code>.authorizeRequests().antMatchers("/api/**").hasIpAddress("dynamic List of IPs");
</code></pre>

<p>It should be checked whether the IP is stored in the database, otherwise the access is to be denied.</p>

<p>And the secound config takes care of the rest.</p>

<pre><code>@EnableWebSecurity

public class AppSecurityConfig {

@Autowired
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(new CustomUserDetailsService()).passwordEncoder(new Md5PasswordEncoder());

}

@Configuration
@Order(1)
public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .headers().disable()
                .authorizeRequests().antMatchers("/api/**").hasIpAddress("dynamic List of IPs");
    }
}

@Configuration
public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.sessionManagement().maximumSessions(1)
                .expiredUrl("/error/expired.xhtml").and()
                .invalidSessionUrl("/Anmeldung.xhtml?check=invalid");
        http
                .csrf().disable()
                .headers().disable()
                .formLogin().loginPage("/Anmeldung/").loginProcessingUrl("/j_spring_security_check").successHandler(new CustomAuthenticationSuccessHandler())
                .failureUrl("/Anmeldung.xhtml?check=error").usernameParameter("j_username").passwordParameter("j_password")
                .and()
                .exceptionHandling().accessDeniedPage("/error/403.xhtml")
                .and()
                .logout().logoutUrl("/logout").logoutSuccessUrl("/Anmeldung.xhtml?check=logout").invalidateHttpSession(false).deleteCookies("JSESSIONID").permitAll();

        ExpressionUrlAuthorizationConfigurer&lt;HttpSecurity&gt;.ExpressionInterceptUrlRegistry interceptUrlRegistry = http.authorizeRequests();
        interceptUrlRegistry.antMatchers("/Administrator/*").hasAnyAuthority("ROLE_ADMIN");
        interceptUrlRegistry.antMatchers("/*").hasAnyAuthority("ROLE_USER");
        interceptUrlRegistry.antMatchers("/Anmeldung/index.xhtml").anonymous();
        interceptUrlRegistry.antMatchers("/template/*").denyAll();
        interceptUrlRegistry.antMatchers("/resources/**").permitAll();
    }
}
}
</code></pre>

<p>Thanks for your help. </p>