title: How to do role-based authorization with Apache Shiro depending on HTTP request method
body: <p>I'm struggling to figure out how I can do role-based authorization depending on what HTTP method a request is using. I use HTTP basic auth and depending on the users role and the HTTP method used a request should succeed or fail.</p>
  
  <p>Example:</p>
  
  <ul>
  <li>a GET request to <code>http://localhost/rest/</code> should always be allowed, even to non-authenticated users (anon access)</li>
  <li>a PUT request to <code>http://localhost/rest/</code> (same resource!) should only be allowed if user is <strong>authenticated</strong></li>
  <li>a DELETE request to <code>http://localhost/rest/</code> (same resource!) should only be allowed if user is <strong>authenticated</strong> and <strong>has the role ADMINISTRATOR</strong></li>
  </ul>
  
  <p>My current (non-working) attempt of configuring <code>shiro.ini</code> looks like this:</p>
  
  <pre><code>/rest = authcBasic[PUT], roles[SERVICE_PROVIDER]
  /rest = authcBasic[POST], roles[EXPERIMENTER]
  /rest = authcBasic[DELETE], roles[ADMINISTRATOR]
  /rest = authcBasic
  </code></pre>
  
  <p><strong>Update</strong></p>
  
  <p>I've just found <a href="https://issues.apache.org/jira/browse/SHIRO-107" rel="nofollow">https://issues.apache.org/jira/browse/SHIRO-107</a> and updated my shiro.ini to be</p>
  
  <pre><code>/rest/**:put    = authcBasic, roles[SERVICE_PROVIDER]
  /rest/**:post   = authcBasic, roles[EXPERIMENTER]
  /rest/**:delete = authcBasic, roles[ADMINISTRATOR]
  /rest/**        = authcBasic
  </code></pre>
  
  <p>but it still doesn't work. It seems that only the last rule matches. Also, the commit comment also seems to indicate that this only works with permission-based authorization. Is there no equivalent implementation for role-based authz?</p>