Ant path pattern tester
Check what a pattern really matches before it reaches aSecurityFilterChain. Enter a pattern and some paths — matches, misses and captured path variables all update as you type.
The three wildcards
| Token | Matches | Crosses a /? |
|---|---|---|
? | Exactly one character | No |
* | Zero or more characters | No |
** | Zero or more path segments | Yes |
{name} | One segment, captured as a path variable | No |
{name:regex} | A segment matching the regex | No |
The one-character difference that leaves an endpoint open:/api/* matches /api/users but not/api/users/42. Writing * where you meant ** in anauthenticated() rule leaves everything deeper than one segment unprotected, and nothing warns you.
`**` matches zero segments too
/api/** matches /api itself, not only paths beneath it. Likewisecom/**/test.jsp matches a plain com/test.jsp. This is usually what you want for a security rule and occasionally a surprise for a resource handler.
AntPathMatcher or PathPattern
Spring has two implementations, and Spring MVC switched its default in 6.0:
AntPathMatcher | PathPatternParser | |
|---|---|---|
| Used by | Older MVC config, resource handlers | Spring MVC 6+, WebFlux |
** in the middle | Allowed | Rejected at startup |
| Capture the rest | /** | {*rest} |
| Speed | Re-parses per request | Parsed once |
A pattern such as /api/**/users works for years underAntPathMatcher and then stops the application from starting after a Spring Boot 3 upgrade. The checker above flags this.
Matching is case sensitive
/api/** does not match /API/users. Servlet containers normally preserve case in the path, so a case-only difference reaches your rules unchanged.