* @Configuration
* @EnableWebSecurity
- * public class MyWebSecurityConfiguration extends WebSecurityConfigurerAdapter {
+ * public class MyWebSecurityConfiguration {
*
- * @Autowired
- * public void configureGlobal(AuthenticationManagerBuilder auth) {
- * auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
- * .and().withUser("admin").password("password").roles("USER", "ADMIN");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * UserDetails admin = User.withDefaultPasswordEncoder()
+ * .username("admin")
+ * .password("password")
+ * .roles("ADMIN", "USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user, admin);
* }
*
- * // Possibly overridden methods ...
+ * // Possibly more bean methods ...
* }
*
*
diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/WebSecurityConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/WebSecurityConfigurer.java
index c7bc0578d5f..91ca1c1a566 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/web/WebSecurityConfigurer.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/web/WebSecurityConfigurer.java
@@ -1,5 +1,5 @@
/*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -23,19 +23,16 @@
import org.springframework.security.config.annotation.SecurityConfigurer;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.SecurityFilterChain;
/**
* Allows customization to the {@link WebSecurity}. In most instances users will use
- * {@link EnableWebSecurity} and either create a {@link Configuration} that extends
- * {@link WebSecurityConfigurerAdapter} or expose a {@link SecurityFilterChain} bean. Both
- * will automatically be applied to the {@link WebSecurity} by the
- * {@link EnableWebSecurity} annotation.
+ * {@link EnableWebSecurity} and create a {@link Configuration} that exposes a
+ * {@link SecurityFilterChain} bean. This will automatically be applied to the
+ * {@link WebSecurity} by the {@link EnableWebSecurity} annotation.
*
* @author Rob Winch
* @since 3.2
- * @see WebSecurityConfigurerAdapter
* @see SecurityFilterChain
*/
public interface WebSecurityConfigurer
* @Configuration
* @EnableWebSecurity
- * public class FormLoginSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class FormLoginSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin();
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -181,22 +186,25 @@ private ApplicationContext getContext() {
*
* @Configuration
* @EnableWebSecurity
- * public class OpenIDLoginConfig extends WebSecurityConfigurerAdapter {
+ * public class OpenIDLoginConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers("/**").hasRole("USER").and().openidLogin()
* .permitAll();
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth.inMemoryAuthentication()
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
* // the username must match the OpenID of the user you are
* // logging in with
- * .withUser(
+ * .username(
* "https://www.google.com/accounts/o8/id?id=lmkCn9xzPdsxVwG7pjYMuDgNNdASFmobNkcRPaWU")
- * .password("password").roles("USER");
+ * .password("password").roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -208,10 +216,10 @@ private ApplicationContext getContext() {
*
* @Configuration
* @EnableWebSecurity
- * public class OpenIDLoginConfig extends WebSecurityConfigurerAdapter {
+ * public class OpenIDLoginConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests()
* .antMatchers("/**")
* .hasRole("USER")
@@ -233,6 +241,7 @@ private ApplicationContext getContext() {
* .attribute("email").type("https://schema.openid.net/contact/email")
* .required(true).and().attribute("fullname")
* .type("https://schema.openid.net/namePerson").required(true);
+ * return http.build();
* }
* }
*
@@ -268,10 +277,10 @@ public OpenIDLoginConfigurer openidLogin() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class OpenIDLoginConfig extends WebSecurityConfigurerAdapter {
+ * public class OpenIDLoginConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
@@ -281,16 +290,19 @@ public OpenIDLoginConfigurer openidLogin() throws Exception {
* openidLogin
* .permitAll()
* );
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth.inMemoryAuthentication()
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
* // the username must match the OpenID of the user you are
* // logging in with
- * .withUser(
+ * .username(
* "https://www.google.com/accounts/o8/id?id=lmkCn9xzPdsxVwG7pjYMuDgNNdASFmobNkcRPaWU")
- * .password("password").roles("USER");
+ * .password("password").roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -302,10 +314,10 @@ public OpenIDLoginConfigurer openidLogin() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class OpenIDLoginConfig extends WebSecurityConfigurerAdapter {
+ * public class OpenIDLoginConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests((authorizeRequests) ->
* authorizeRequests
* .antMatchers("/**").hasRole("USER")
@@ -355,6 +367,7 @@ public OpenIDLoginConfigurer openidLogin() throws Exception {
* )
* )
* );
+ * return http.build();
* }
* }
*
@@ -386,17 +399,17 @@ public HttpSecurity openidLogin(Customizer>
/**
* Adds the Security headers to the response. This is activated by default when using
- * {@link WebSecurityConfigurerAdapter}'s default constructor. Accepting the default
- * provided by {@link WebSecurityConfigurerAdapter} or only invoking
- * {@link #headers()} without invoking additional methods on it, is the equivalent of:
+ * {@link EnableWebSecurity}. Accepting the default provided by
+ * {@link EnableWebSecurity} or only invoking {@link #headers()} without invoking
+ * additional methods on it, is the equivalent of:
*
*
* @Configuration
* @EnableWebSecurity
- * public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class CsrfSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .headers()
* .contentTypeOptions()
@@ -410,6 +423,7 @@ public HttpSecurity openidLogin(Customizer>
* .frameOptions()
* .and()
* ...;
+ * return http.build();
* }
* }
*
@@ -419,13 +433,14 @@ public HttpSecurity openidLogin(Customizer>
*
* @Configuration
* @EnableWebSecurity
- * public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class CsrfSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .headers().disable()
* ...;
+ * return http.build();
* }
* }
*
@@ -439,10 +454,10 @@ public HttpSecurity openidLogin(Customizer>
*
* @Configuration
* @EnableWebSecurity
- * public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class CsrfSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .headers()
* .defaultsDisabled()
@@ -451,6 +466,7 @@ public HttpSecurity openidLogin(Customizer>
* .frameOptions()
* .and()
* ...;
+ * return http.build();
* }
* }
*
@@ -462,16 +478,17 @@ public HttpSecurity openidLogin(Customizer>
*
* @Configuration
* @EnableWebSecurity
- * public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class CsrfSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .headers()
* .frameOptions()
* .disable()
* .and()
* ...;
+ * return http.build();
* }
* }
*
@@ -485,21 +502,20 @@ public HeadersConfigurer headers() throws Exception {
/**
* Adds the Security headers to the response. This is activated by default when using
- * {@link WebSecurityConfigurerAdapter}'s default constructor.
+ * {@link EnableWebSecurity}.
*
* Example Configurations
*
- * Accepting the default provided by {@link WebSecurityConfigurerAdapter} or only
- * invoking {@link #headers()} without invoking additional methods on it, is the
- * equivalent of:
+ * Accepting the default provided by {@link EnableWebSecurity} or only invoking
+ * {@link #headers()} without invoking additional methods on it, is the equivalent of:
*
*
* @Configuration
* @EnableWebSecurity
- * public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class CsrfSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .headers((headers) ->
* headers
@@ -509,6 +525,7 @@ public HeadersConfigurer headers() throws Exception {
* .httpStrictTransportSecurity(withDefaults())
* .frameOptions(withDefaults()
* );
+ * return http.build();
* }
* }
*
@@ -518,12 +535,13 @@ public HeadersConfigurer headers() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class CsrfSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .headers((headers) -> headers.disable());
+ * return http.build();
* }
* }
*
@@ -537,10 +555,10 @@ public HeadersConfigurer headers() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class CsrfSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .headers((headers) ->
* headers
@@ -548,6 +566,7 @@ public HeadersConfigurer headers() throws Exception {
* .cacheControl(withDefaults())
* .frameOptions(withDefaults())
* );
+ * return http.build();
* }
* }
*
@@ -559,15 +578,17 @@ public HeadersConfigurer headers() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class CsrfSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .headers((headers) ->
* headers
* .frameOptions((frameOptions) -> frameOptions.disable())
* );
+ * return http.build();
+ * }
* }
*
* @param headersCustomizer the {@link Customizer} to provide more options for the
@@ -602,12 +623,13 @@ public CorsConfigurer cors() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class CorsSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class CorsSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .cors(withDefaults());
+ * return http.build();
* }
* }
*
@@ -634,18 +656,24 @@ public HttpSecurity cors(Customizer> corsCustomizer
*
* @Configuration
* @EnableWebSecurity
- * public class SessionManagementSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class SessionManagementSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().anyRequest().hasRole("USER").and().formLogin()
* .permitAll().and().sessionManagement().maximumSessions(1)
* .expiredUrl("/login?expired");
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -685,10 +713,10 @@ public SessionManagementConfigurer sessionManagement() throws Exce
*
* @Configuration
* @EnableWebSecurity
- * public class SessionManagementSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class SessionManagementSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
@@ -706,6 +734,17 @@ public SessionManagementConfigurer sessionManagement() throws Exce
* .expiredUrl("/login?expired")
* )
* );
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -754,19 +793,25 @@ public HttpSecurity sessionManagement(
*
* @Configuration
* @EnableWebSecurity
- * public class PortMapperSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class PortMapperSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin()
* .permitAll().and()
* // Example portMapper() configuration
* .portMapper().http(9090).mapsTo(9443).http(80).mapsTo(443);
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -796,10 +841,10 @@ public PortMapperConfigurer portMapper() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class PortMapperSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class PortMapperSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .requiresChannel((requiresChannel) ->
* requiresChannel
@@ -810,6 +855,17 @@ public PortMapperConfigurer portMapper() throws Exception {
* .http(9090).mapsTo(9443)
* .http(80).mapsTo(443)
* );
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -838,13 +894,14 @@ public HttpSecurity portMapper(Customizer> po
*
* @Configuration
* @EnableWebSecurity
- * public class JeeSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class JeeSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers("/**").hasRole("USER").and()
* // Example jee() configuration
* .jee().mappableRoles("USER", "ADMIN");
+ * return http.build();
* }
* }
*
@@ -909,10 +966,10 @@ public JeeConfigurer jee() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class JeeSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class JeeSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
@@ -922,6 +979,7 @@ public JeeConfigurer jee() throws Exception {
* jee
* .mappableRoles("USER", "ADMIN")
* );
+ * return http.build();
* }
* }
*
@@ -988,13 +1046,14 @@ public HttpSecurity jee(Customizer> jeeCustomizer) t
*
* @Configuration
* @EnableWebSecurity
- * public class X509SecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class X509SecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers("/**").hasRole("USER").and()
* // Example x509() configuration
* .x509();
+ * return http.build();
* }
* }
*
@@ -1017,16 +1076,17 @@ public X509Configurer x509() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class X509SecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class X509SecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
* .antMatchers("/**").hasRole("USER")
* )
* .x509(withDefaults());
+ * return http.build();
* }
* }
*
@@ -1053,19 +1113,25 @@ public HttpSecurity x509(Customizer> x509Customizer
*
* @Configuration
* @EnableWebSecurity
- * public class RememberMeSecurityConfig extends WebSecurityConfigurerAdapter {
- *
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
- * }
+ * public class RememberMeSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin()
* .permitAll().and()
* // Example Remember Me Configuration
* .rememberMe();
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -1089,10 +1155,10 @@ public RememberMeConfigurer rememberMe() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class RememberMeSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class RememberMeSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
@@ -1100,6 +1166,17 @@ public RememberMeConfigurer rememberMe() throws Exception {
* )
* .formLogin(withDefaults())
* .rememberMe(withDefaults());
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -1127,17 +1204,27 @@ public HttpSecurity rememberMe(Customizer> re
*
* @Configuration
* @EnableWebSecurity
- * public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class AuthorizeUrlsSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin();
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
- * .and().withUser("admin").password("password").roles("ADMIN", "USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * UserDetails admin = User.withDefaultPasswordEncoder()
+ * .username("admin")
+ * .password("password")
+ * .roles("ADMIN", "USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user, admin);
* }
* }
*
@@ -1149,18 +1236,28 @@ public HttpSecurity rememberMe(Customizer> re
*
* @Configuration
* @EnableWebSecurity
- * public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class AuthorizeUrlsSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers("/admin/**").hasRole("ADMIN")
* .antMatchers("/**").hasRole("USER").and().formLogin();
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
- * .and().withUser("admin").password("password").roles("ADMIN", "USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * UserDetails admin = User.withDefaultPasswordEncoder()
+ * .username("admin")
+ * .password("password")
+ * .roles("ADMIN", "USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user, admin);
* }
* }
*
@@ -1170,8 +1267,17 @@ public HttpSecurity rememberMe(Customizer> re
* mapping:
*
*
- * http.authorizeRequests().antMatchers("/**").hasRole("USER").antMatchers("/admin/**")
- * .hasRole("ADMIN")
+ * @Configuration
+ * @EnableWebSecurity
+ * public class AuthorizeUrlsSecurityConfig {
+ *
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+ * http.authorizeRequests().antMatchers("/**").hasRole("USER").antMatchers("/admin/**")
+ * .hasRole("ADMIN")
+ * return http.build();
+ * }
+ * }
*
* @return the {@link ExpressionUrlAuthorizationConfigurer} for further customizations
* @throws Exception
@@ -1196,16 +1302,32 @@ public ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrl
*
* @Configuration
* @EnableWebSecurity
- * public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class AuthorizeUrlsSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
* .antMatchers("/**").hasRole("USER")
* )
* .formLogin(withDefaults());
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * UserDetails admin = User.withDefaultPasswordEncoder()
+ * .username("admin")
+ * .password("password")
+ * .roles("ADMIN", "USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user, admin);
* }
* }
*
@@ -1217,10 +1339,10 @@ public ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrl
*
* @Configuration
* @EnableWebSecurity
- * public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class AuthorizeUrlsSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
@@ -1228,6 +1350,22 @@ public ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrl
* .antMatchers("/**").hasRole("USER")
* )
* .formLogin(withDefaults());
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * UserDetails admin = User.withDefaultPasswordEncoder()
+ * .username("admin")
+ * .password("password")
+ * .roles("ADMIN", "USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user, admin);
* }
* }
*
@@ -1239,16 +1377,17 @@ public ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrl
*
* @Configuration
* @EnableWebSecurity
- * public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class AuthorizeUrlsSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
* .antMatchers("/**").hasRole("USER")
* .antMatchers("/admin/**").hasRole("ADMIN")
* );
+ * return http.build();
* }
* }
*
@@ -1280,15 +1419,31 @@ public HttpSecurity authorizeRequests(
*
* @Configuration
* @EnableWebSecurity
- * public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class AuthorizeUrlsSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeHttpRequests()
* .antMatchers("/**").hasRole("USER")
* .and()
* .formLogin();
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * UserDetails admin = User.withDefaultPasswordEncoder()
+ * .username("admin")
+ * .password("password")
+ * .roles("ADMIN", "USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user, admin);
* }
* }
*
@@ -1300,16 +1455,32 @@ public HttpSecurity authorizeRequests(
*
* @Configuration
* @EnableWebSecurity
- * public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class AuthorizeUrlsSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeHttpRequests()
* .antMatchers("/admin").hasRole("ADMIN")
* .antMatchers("/**").hasRole("USER")
* .and()
* .formLogin();
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * UserDetails admin = User.withDefaultPasswordEncoder()
+ * .username("admin")
+ * .password("password")
+ * .roles("ADMIN", "USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user, admin);
* }
* }
*
@@ -1321,16 +1492,17 @@ public HttpSecurity authorizeRequests(
*
* @Configuration
* @EnableWebSecurity
- * public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class AuthorizeUrlsSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeHttpRequests()
* .antMatchers("/**").hasRole("USER")
* .antMatchers("/admin/**").hasRole("ADMIN")
* .and()
* .formLogin();
+ * return http.build();
* }
* }
*
@@ -1358,16 +1530,32 @@ public AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequest
*
* @Configuration
* @EnableWebSecurity
- * public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class AuthorizeUrlsSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeHttpRequests((authorizeHttpRequests) ->
* authorizeHttpRequests
* .antMatchers("/**").hasRole("USER")
* )
* .formLogin(withDefaults());
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * UserDetails admin = User.withDefaultPasswordEncoder()
+ * .username("admin")
+ * .password("password")
+ * .roles("ADMIN", "USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user, admin);
* }
* }
*
@@ -1379,10 +1567,10 @@ public AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequest
*
* @Configuration
* @EnableWebSecurity
- * public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class AuthorizeUrlsSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeHttpRequests((authorizeHttpRequests) ->
* authorizeHttpRequests
@@ -1390,6 +1578,22 @@ public AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequest
* .antMatchers("/**").hasRole("USER")
* )
* .formLogin(withDefaults());
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * UserDetails admin = User.withDefaultPasswordEncoder()
+ * .username("admin")
+ * .password("password")
+ * .roles("ADMIN", "USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user, admin);
* }
* }
*
@@ -1401,16 +1605,17 @@ public AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequest
*
* @Configuration
* @EnableWebSecurity
- * public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class AuthorizeUrlsSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeHttpRequests((authorizeHttpRequests) ->
* authorizeHttpRequests
* .antMatchers("/**").hasRole("USER")
* .antMatchers("/admin/**").hasRole("ADMIN")
* );
+ * return http.build();
* }
* }
*
@@ -1435,7 +1640,7 @@ public HttpSecurity authorizeHttpRequests(
* may be requested prior to authentication. The application will redirect the user to
* a login page. After authentication, Spring Security will redirect the user to the
* originally requested protected page (/protected). This is automatically applied
- * when using {@link WebSecurityConfigurerAdapter}.
+ * when using {@link EnableWebSecurity}.
* @return the {@link RequestCacheConfigurer} for further customizations
* @throws Exception
*/
@@ -1448,7 +1653,7 @@ public RequestCacheConfigurer requestCache() throws Exception {
* may be requested prior to authentication. The application will redirect the user to
* a login page. After authentication, Spring Security will redirect the user to the
* originally requested protected page (/protected). This is automatically applied
- * when using {@link WebSecurityConfigurerAdapter}.
+ * when using {@link EnableWebSecurity}.
*
* Example Custom Configuration
*
@@ -1457,10 +1662,10 @@ public RequestCacheConfigurer requestCache() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class RequestCacheDisabledSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class RequestCacheDisabledSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
@@ -1469,6 +1674,7 @@ public RequestCacheConfigurer requestCache() throws Exception {
* .requestCache((requestCache) ->
* requestCache.disable()
* );
+ * return http.build();
* }
* }
*
@@ -1485,7 +1691,7 @@ public HttpSecurity requestCache(Customizer
/**
* Allows configuring exception handling. This is automatically applied when using
- * {@link WebSecurityConfigurerAdapter}.
+ * {@link EnableWebSecurity}.
* @return the {@link ExceptionHandlingConfigurer} for further customizations
* @throws Exception
*/
@@ -1495,7 +1701,7 @@ public ExceptionHandlingConfigurer exceptionHandling() throws Exce
/**
* Allows configuring exception handling. This is automatically applied when using
- * {@link WebSecurityConfigurerAdapter}.
+ * {@link EnableWebSecurity}.
*
* Example Custom Configuration
*
@@ -1505,10 +1711,10 @@ public ExceptionHandlingConfigurer exceptionHandling() throws Exce
*
* @Configuration
* @EnableWebSecurity
- * public class ExceptionHandlingSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class ExceptionHandlingSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
@@ -1519,6 +1725,7 @@ public ExceptionHandlingConfigurer exceptionHandling() throws Exce
* exceptionHandling
* .accessDeniedPage("/errors/access-denied")
* );
+ * return http.build();
* }
* }
*
@@ -1536,7 +1743,7 @@ public HttpSecurity exceptionHandling(
/**
* Sets up management of the {@link SecurityContext} on the
* {@link SecurityContextHolder} between {@link HttpServletRequest}'s. This is
- * automatically applied when using {@link WebSecurityConfigurerAdapter}.
+ * automatically applied when using {@link EnableWebSecurity}.
* @return the {@link SecurityContextConfigurer} for further customizations
* @throws Exception
*/
@@ -1547,22 +1754,23 @@ public SecurityContextConfigurer securityContext() throws Exceptio
/**
* Sets up management of the {@link SecurityContext} on the
* {@link SecurityContextHolder} between {@link HttpServletRequest}'s. This is
- * automatically applied when using {@link WebSecurityConfigurerAdapter}.
+ * automatically applied when using {@link EnableWebSecurity}.
*
* The following customization specifies the shared {@link SecurityContextRepository}
*
*
* @Configuration
* @EnableWebSecurity
- * public class SecurityContextSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class SecurityContextSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .securityContext((securityContext) ->
* securityContext
* .securityContextRepository(SCR)
* );
+ * return http.build();
* }
* }
*
@@ -1580,7 +1788,7 @@ public HttpSecurity securityContext(Customizer servletApi() throws Exception {
/**
* Integrates the {@link HttpServletRequest} methods with the values found on the
* {@link SecurityContext}. This is automatically applied when using
- * {@link WebSecurityConfigurerAdapter}. You can disable it using:
+ * {@link EnableWebSecurity}. You can disable it using:
*
*
* @Configuration
* @EnableWebSecurity
- * public class ServletApiSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class ServletApiSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .servletApi((servletApi) ->
* servletApi.disable()
* );
+ * return http.build();
* }
* }
*
@@ -1620,19 +1829,19 @@ public HttpSecurity servletApi(Customizer> se
/**
* Enables CSRF protection. This is activated by default when using
- * {@link WebSecurityConfigurerAdapter}'s default constructor. You can disable it
- * using:
+ * {@link EnableWebSecurity}'s default constructor. You can disable it using:
*
*
* @Configuration
* @EnableWebSecurity
- * public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class CsrfSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .csrf().disable()
* ...;
+ * return http.build();
* }
* }
*
@@ -1646,18 +1855,18 @@ public CsrfConfigurer csrf() throws Exception {
/**
* Enables CSRF protection. This is activated by default when using
- * {@link WebSecurityConfigurerAdapter}'s default constructor. You can disable it
- * using:
+ * {@link EnableWebSecurity}. You can disable it using:
*
*
* @Configuration
* @EnableWebSecurity
- * public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class CsrfSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .csrf((csrf) -> csrf.disable());
+ * return http.build();
* }
* }
*
@@ -1674,8 +1883,8 @@ public HttpSecurity csrf(Customizer> csrfCustomizer
/**
* Provides logout support. This is automatically applied when using
- * {@link WebSecurityConfigurerAdapter}. The default is that accessing the URL
- * "/logout" will log the user out by invalidating the HTTP Session, cleaning up any
+ * {@link EnableWebSecurity}. The default is that accessing the URL "/logout" will log
+ * the user out by invalidating the HTTP Session, cleaning up any
* {@link #rememberMe()} authentication that was configured, clearing the
* {@link SecurityContextHolder}, and then redirect to "/login?success".
*
@@ -1688,20 +1897,26 @@ public HttpSecurity csrf(Customizer> csrfCustomizer
*
* @Configuration
* @EnableWebSecurity
- * public class LogoutSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class LogoutSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin()
* .and()
* // sample logout customization
* .logout().deleteCookies("remove").invalidateHttpSession(false)
* .logoutUrl("/custom-logout").logoutSuccessUrl("/logout-success");
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -1714,8 +1929,8 @@ public LogoutConfigurer logout() throws Exception {
/**
* Provides logout support. This is automatically applied when using
- * {@link WebSecurityConfigurerAdapter}. The default is that accessing the URL
- * "/logout" will log the user out by invalidating the HTTP Session, cleaning up any
+ * {@link EnableWebSecurity}. The default is that accessing the URL "/logout" will log
+ * the user out by invalidating the HTTP Session, cleaning up any
* {@link #rememberMe()} authentication that was configured, clearing the
* {@link SecurityContextHolder}, and then redirect to "/login?success".
*
@@ -1728,10 +1943,10 @@ public LogoutConfigurer logout() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class LogoutSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class LogoutSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
@@ -1745,6 +1960,17 @@ public LogoutConfigurer logout() throws Exception {
* .logoutUrl("/custom-logout")
* .logoutSuccessUrl("/logout-success")
* );
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -1760,8 +1986,8 @@ public HttpSecurity logout(Customizer> logoutCust
/**
* Allows configuring how an anonymous user is represented. This is automatically
- * applied when used in conjunction with {@link WebSecurityConfigurerAdapter}. By
- * default anonymous users will be represented with an
+ * applied when used in conjunction with {@link EnableWebSecurity}. By default
+ * anonymous users will be represented with an
* {@link org.springframework.security.authentication.AnonymousAuthenticationToken}
* and contain the role "ROLE_ANONYMOUS".
*
@@ -1773,10 +1999,10 @@ public HttpSecurity logout(Customizer> logoutCust
*
* @Configuration
* @EnableWebSecurity
- * public class AnonymousSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class AnonymousSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests()
* .antMatchers("/**").hasRole("USER")
@@ -1785,11 +2011,17 @@ public HttpSecurity logout(Customizer> logoutCust
* .and()
* // sample anonymous customization
* .anonymous().authorities("ROLE_ANON");
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -1801,10 +2033,10 @@ public HttpSecurity logout(Customizer> logoutCust
*
* @Configuration
* @EnableWebSecurity
- * public class AnonymousSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class AnonymousSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests()
* .antMatchers("/**").hasRole("USER")
@@ -1813,11 +2045,17 @@ public HttpSecurity logout(Customizer> logoutCust
* .and()
* // sample anonymous customization
* .anonymous().disable();
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -1830,8 +2068,8 @@ public AnonymousConfigurer anonymous() throws Exception {
/**
* Allows configuring how an anonymous user is represented. This is automatically
- * applied when used in conjunction with {@link WebSecurityConfigurerAdapter}. By
- * default anonymous users will be represented with an
+ * applied when used in conjunction with {@link EnableWebSecurity}. By default
+ * anonymous users will be represented with an
* {@link org.springframework.security.authentication.AnonymousAuthenticationToken}
* and contain the role "ROLE_ANONYMOUS".
*
@@ -1843,10 +2081,10 @@ public AnonymousConfigurer anonymous() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class AnonymousSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class AnonymousSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
@@ -1857,7 +2095,18 @@ public AnonymousConfigurer anonymous() throws Exception {
* .anonymous((anonymous) ->
* anonymous
* .authorities("ROLE_ANON")
- * )
+ * );
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -1869,10 +2118,10 @@ public AnonymousConfigurer anonymous() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class AnonymousSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class AnonymousSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
@@ -1883,11 +2132,17 @@ public AnonymousConfigurer anonymous() throws Exception {
* .anonymous((anonymous) ->
* anonymous.disable()
* );
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -1916,16 +2171,22 @@ public HttpSecurity anonymous(Customizer> anon
*
* @Configuration
* @EnableWebSecurity
- * public class FormLoginSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class FormLoginSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin();
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -1935,10 +2196,10 @@ public HttpSecurity anonymous(Customizer> anon
*
* @Configuration
* @EnableWebSecurity
- * public class FormLoginSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class FormLoginSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin()
* .usernameParameter("username") // default is username
* .passwordParameter("password") // default is password
@@ -1947,11 +2208,17 @@ public HttpSecurity anonymous(Customizer> anon
* .loginProcessingUrl("/authentication/login/process"); // default is /login
* // with an HTTP
* // post
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -1978,16 +2245,27 @@ public FormLoginConfigurer formLogin() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class FormLoginSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class FormLoginSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
* .antMatchers("/**").hasRole("USER")
* )
* .formLogin(withDefaults());
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -1997,10 +2275,10 @@ public FormLoginConfigurer formLogin() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class FormLoginSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class FormLoginSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
@@ -2014,6 +2292,17 @@ public FormLoginConfigurer formLogin() throws Exception {
* .failureUrl("/authentication/login?failed")
* .loginProcessingUrl("/authentication/login/process")
* );
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -2065,19 +2354,18 @@ public HttpSecurity formLogin(Customizer> form
*
*
* @Configuration
- * public class Saml2LoginConfig {
+ * @EnableWebSecurity
+ * public class Saml2LoginSecurityConfig {
*
- * @EnableWebSecurity
- * public static class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
- * http
- * .authorizeRequests()
- * .anyRequest().authenticated()
- * .and()
- * .saml2Login();
- * }
- * }
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+ * http
+ * .authorizeRequests()
+ * .anyRequest().authenticated()
+ * .and()
+ * .saml2Login();
+ * return http.build();
+ * }
*
* @Bean
* public RelyingPartyRegistrationRepository relyingPartyRegistrationRepository() {
@@ -2098,13 +2386,13 @@ public HttpSecurity formLogin(Customizer> form
* //IDP certificate for verification of incoming messages
* Saml2X509Credential idpVerificationCertificate = getVerificationCertificate();
* return RelyingPartyRegistration.withRegistrationId(registrationId)
- * * .remoteIdpEntityId(idpEntityId)
- * * .idpWebSsoUrl(webSsoEndpoint)
- * * .credential(signingCredential)
- * * .credential(idpVerificationCertificate)
- * * .localEntityIdTemplate(localEntityIdTemplate)
- * * .build();
- * }
+ * .remoteIdpEntityId(idpEntityId)
+ * .idpWebSsoUrl(webSsoEndpoint)
+ * .credential(signingCredential)
+ * .credential(idpVerificationCertificate)
+ * .localEntityIdTemplate(localEntityIdTemplate)
+ * .build();
+ * }
* }
*
*
@@ -2154,19 +2442,19 @@ public Saml2LoginConfigurer saml2Login() throws Exception {
*
*
* @Configuration
- * public class Saml2LoginConfig {
+ * @EnableWebSecurity
+ * public class Saml2LoginSecurityConfig {
*
- * @EnableWebSecurity
- * public static class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
- * http
- * .authorizeRequests()
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+ * http
+ * .authorizeRequests((authorizeRequests) ->
+ * authorizeRequests
* .anyRequest().authenticated()
- * .and()
- * .saml2Login(withDefaults());
- * }
- * }
+ * )
+ * .saml2Login(withDefaults());
+ * return http.build();
+ * }
*
* @Bean
* public RelyingPartyRegistrationRepository relyingPartyRegistrationRepository() {
@@ -2187,13 +2475,13 @@ public Saml2LoginConfigurer saml2Login() throws Exception {
* //IDP certificate for verification of incoming messages
* Saml2X509Credential idpVerificationCertificate = getVerificationCertificate();
* return RelyingPartyRegistration.withRegistrationId(registrationId)
- * * .remoteIdpEntityId(idpEntityId)
- * * .idpWebSsoUrl(webSsoEndpoint)
- * * .credential(signingCredential)
- * * .credential(idpVerificationCertificate)
- * * .localEntityIdTemplate(localEntityIdTemplate)
- * * .build();
- * }
+ * .remoteIdpEntityId(idpEntityId)
+ * .idpWebSsoUrl(webSsoEndpoint)
+ * .credential(signingCredential)
+ * .credential(idpVerificationCertificate)
+ * .localEntityIdTemplate(localEntityIdTemplate)
+ * .build();
+ * }
* }
*
*
@@ -2390,19 +2678,18 @@ public Saml2LogoutConfigurer saml2Logout() throws Exception {
*
*
* @Configuration
- * public class OAuth2LoginConfig {
+ * @EnableWebSecurity
+ * public class OAuth2LoginSecurityConfig {
*
- * @EnableWebSecurity
- * public static class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
- * http
- * .authorizeRequests()
- * .anyRequest().authenticated()
- * .and()
- * .oauth2Login();
- * }
- * }
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+ * http
+ * .authorizeRequests()
+ * .anyRequest().authenticated()
+ * .and()
+ * .oauth2Login();
+ * return http.build();
+ * }
*
* @Bean
* public ClientRegistrationRepository clientRegistrationRepository() {
@@ -2490,20 +2777,19 @@ public OAuth2LoginConfigurer oauth2Login() throws Exception {
*
*
* @Configuration
- * public class OAuth2LoginConfig {
+ * @EnableWebSecurity
+ * public class OAuth2LoginSecurityConfig {
*
- * @EnableWebSecurity
- * public static class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
- * http
- * .authorizeRequests((authorizeRequests) ->
- * authorizeRequests
- * .anyRequest().authenticated()
- * )
- * .oauth2Login(withDefaults());
- * }
- * }
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
+ * http
+ * .authorizeRequests((authorizeRequests) ->
+ * authorizeRequests
+ * .anyRequest().authenticated()
+ * )
+ * .oauth2Login(withDefaults());
+ * return http.build();
+ * }
*
* @Bean
* public ClientRegistrationRepository clientRegistrationRepository() {
@@ -2577,16 +2863,18 @@ public OAuth2ClientConfigurer oauth2Client() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class OAuth2ClientSecurityConfig extends WebSecurityConfigurerAdapter {
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * public class OAuth2ClientSecurityConfig {
+ *
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
* .anyRequest().authenticated()
* )
* .oauth2Client(withDefaults());
- * }
+ * return http.build();
+ * }
* }
*
* @param oauth2ClientCustomizer the {@link Customizer} to provide more options for
@@ -2630,13 +2918,10 @@ public OAuth2ResourceServerConfigurer oauth2ResourceServer() throw
*
* @Configuration
* @EnableWebSecurity
- * public class OAuth2ClientSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class OAuth2ResourceServerSecurityConfig {
*
- * @Value("${spring.security.oauth2.resourceserver.jwt.key-value}")
- * RSAPublicKey key;
- *
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
@@ -2649,7 +2934,8 @@ public OAuth2ResourceServerConfigurer oauth2ResourceServer() throw
* .decoder(jwtDecoder())
* )
* );
- * }
+ * return http.build();
+ * }
*
* @Bean
* public JwtDecoder jwtDecoder() {
@@ -2689,17 +2975,23 @@ public HttpSecurity oauth2ResourceServer(
*
* @Configuration
* @EnableWebSecurity
- * public class ChannelSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class ChannelSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin()
* .and().requiresChannel().anyRequest().requiresSecure();
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -2726,10 +3018,10 @@ public ChannelSecurityConfigurer.ChannelRequestMatcherRegistry req
*
* @Configuration
* @EnableWebSecurity
- * public class ChannelSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class ChannelSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
@@ -2740,6 +3032,17 @@ public ChannelSecurityConfigurer.ChannelRequestMatcherRegistry req
* requiresChannel
* .anyRequest().requiresSecure()
* );
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -2768,16 +3071,22 @@ public HttpSecurity requiresChannel(
*
* @Configuration
* @EnableWebSecurity
- * public class HttpBasicSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class HttpBasicSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http.authorizeRequests().antMatchers("/**").hasRole("USER").and().httpBasic();
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -2800,16 +3109,27 @@ public HttpBasicConfigurer httpBasic() throws Exception {
*
* @Configuration
* @EnableWebSecurity
- * public class HttpBasicSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class HttpBasicSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests((authorizeRequests) ->
* authorizeRequests
* .antMatchers("/**").hasRole("USER")
* )
* .httpBasic(withDefaults());
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -2834,10 +3154,10 @@ public HttpSecurity httpBasic(Customizer> http
*
* @Configuration
* @EnableWebSecurity
- * public class PasswordManagementSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class PasswordManagementSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests(authorizeRequests ->
* authorizeRequests
@@ -2847,7 +3167,8 @@ public HttpSecurity httpBasic(Customizer> http
* passwordManagement
* .changePasswordPage("/custom-change-password-page")
* );
- * }
+ * return http.build();
+ * }
* }
*
* @param passwordManagementCustomizer the {@link Customizer} to provide more options
@@ -2995,10 +3316,10 @@ public HttpSecurity addFilterAt(Filter filter, Class atFilter)
*
* @Configuration
* @EnableWebSecurity
- * public class RequestMatchersSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class RequestMatchersSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .requestMatchers()
* .antMatchers("/api/**", "/oauth/**")
@@ -3007,13 +3328,17 @@ public HttpSecurity addFilterAt(Filter filter, Class atFilter)
* .antMatchers("/**").hasRole("USER")
* .and()
* .httpBasic();
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth
- * .inMemoryAuthentication()
- * .withUser("user").password("password").roles("USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -3023,10 +3348,10 @@ public HttpSecurity addFilterAt(Filter filter, Class atFilter)
*
* @Configuration
* @EnableWebSecurity
- * public class RequestMatchersSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class RequestMatchersSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .requestMatchers()
* .antMatchers("/api/**")
@@ -3036,13 +3361,17 @@ public HttpSecurity addFilterAt(Filter filter, Class atFilter)
* .antMatchers("/**").hasRole("USER")
* .and()
* .httpBasic();
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth
- * .inMemoryAuthentication()
- * .withUser("user").password("password").roles("USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -3052,10 +3381,10 @@ public HttpSecurity addFilterAt(Filter filter, Class atFilter)
*
* @Configuration
* @EnableWebSecurity
- * public class RequestMatchersSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class RequestMatchersSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .requestMatchers()
* .antMatchers("/api/**")
@@ -3067,13 +3396,17 @@ public HttpSecurity addFilterAt(Filter filter, Class atFilter)
* .antMatchers("/**").hasRole("USER")
* .and()
* .httpBasic();
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth) throws Exception {
- * auth
- * .inMemoryAuthentication()
- * .withUser("user").password("password").roles("USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -3106,10 +3439,10 @@ public RequestMatcherConfigurer requestMatchers() {
*
* @Configuration
* @EnableWebSecurity
- * public class RequestMatchersSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class RequestMatchersSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .requestMatchers((requestMatchers) ->
* requestMatchers
@@ -3120,6 +3453,17 @@ public RequestMatcherConfigurer requestMatchers() {
* .antMatchers("/**").hasRole("USER")
* )
* .httpBasic(withDefaults());
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -3129,10 +3473,10 @@ public RequestMatcherConfigurer requestMatchers() {
*
* @Configuration
* @EnableWebSecurity
- * public class RequestMatchersSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class RequestMatchersSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .requestMatchers((requestMatchers) ->
* requestMatchers
@@ -3144,6 +3488,17 @@ public RequestMatcherConfigurer requestMatchers() {
* .antMatchers("/**").hasRole("USER")
* )
* .httpBasic(withDefaults());
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -3153,10 +3508,10 @@ public RequestMatcherConfigurer requestMatchers() {
*
* @Configuration
* @EnableWebSecurity
- * public class RequestMatchersSecurityConfig extends WebSecurityConfigurerAdapter {
+ * public class RequestMatchersSecurityConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) throws Exception {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .requestMatchers((requestMatchers) ->
* requestMatchers
@@ -3171,6 +3526,17 @@ public RequestMatcherConfigurer requestMatchers() {
* .antMatchers("/**").hasRole("USER")
* )
* .httpBasic(withDefaults());
+ * return http.build();
+ * }
+ *
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("user")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java b/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java
index 4364968a3de..1548efdf6bd 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java
@@ -42,7 +42,6 @@
import org.springframework.security.config.annotation.web.WebSecurityConfigurer;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.web.DefaultSecurityFilterChain;
@@ -77,8 +76,7 @@
*
*
* Customizations to the {@link WebSecurity} can be made by creating a
- * {@link WebSecurityConfigurer}, overriding {@link WebSecurityConfigurerAdapter} or
- * exposing a {@link WebSecurityCustomizer} bean.
+ * {@link WebSecurityConfigurer} or exposing a {@link WebSecurityCustomizer} bean.
*
*
* @author Rob Winch
@@ -200,7 +198,7 @@ public WebSecurity debug(boolean debugEnabled) {
*
*
* Typically this method is invoked automatically within the framework from
- * {@link WebSecurityConfigurerAdapter#init(WebSecurity)}
+ * {@link WebSecurityConfiguration#springSecurityFilterChain()}
*
* @param securityFilterChainBuilder the builder to use to create the
* {@link SecurityFilterChain} instances
@@ -258,7 +256,7 @@ public WebInvocationPrivilegeEvaluator getPrivilegeEvaluator() {
/**
* Sets the {@link FilterSecurityInterceptor}. This is typically invoked by
- * {@link WebSecurityConfigurerAdapter}.
+ * {@link WebSecurityConfiguration#springSecurityFilterChain()}.
* @param securityInterceptor the {@link FilterSecurityInterceptor} to use
* @return the {@link WebSecurity} for further customizations
* @deprecated Use {@link #privilegeEvaluator(WebInvocationPrivilegeEvaluator)}
@@ -297,8 +295,7 @@ public WebSecurity requestRejectedHandler(RequestRejectedHandler requestRejected
protected Filter performBuild() throws Exception {
Assert.state(!this.securityFilterChainBuilders.isEmpty(),
() -> "At least one SecurityBuilder needs to be specified. "
- + "Typically this is done by exposing a SecurityFilterChain bean "
- + "or by adding a @Configuration that extends WebSecurityConfigurerAdapter. "
+ + "Typically this is done by exposing a SecurityFilterChain bean. "
+ "More advanced users can invoke " + WebSecurity.class.getSimpleName()
+ ".addSecurityFilterChainBuilder directly");
int chainSize = this.ignoredRequests.size() + this.securityFilterChainBuilders.size();
diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java b/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java
index 1af50254c94..9d73ce7536c 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java
@@ -1,5 +1,5 @@
/*
- * Copyright 2002-2021 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -54,10 +54,9 @@
/**
* Uses a {@link WebSecurity} to create the {@link FilterChainProxy} that performs the web
* based security for Spring Security. It then exports the necessary beans. Customizations
- * can be made to {@link WebSecurity} by extending {@link WebSecurityConfigurerAdapter}
- * and exposing it as a {@link Configuration} or implementing
- * {@link WebSecurityConfigurer} and exposing it as a {@link Configuration}. This
- * configuration is imported when using {@link EnableWebSecurity}.
+ * can be made to {@link WebSecurity} by implementing {@link WebSecurityConfigurer} and
+ * exposing it as a {@link Configuration} or exposing a {@link WebSecurityCustomizer}
+ * bean. This configuration is imported when using {@link EnableWebSecurity}.
*
* @author Rob Winch
* @author Keesun Baik
diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/AbstractAuthenticationFilterConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/AbstractAuthenticationFilterConfigurer.java
index 44a8e840216..1b2eb3fc7c6 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/AbstractAuthenticationFilterConfigurer.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/AbstractAuthenticationFilterConfigurer.java
@@ -25,7 +25,7 @@
import org.springframework.security.authentication.AuthenticationDetailsSource;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.openid.OpenIDLoginConfigurer;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.PortMapper;
@@ -307,14 +307,14 @@ public void configure(B http) throws Exception {
/**
*
* Specifies the URL to send users to if login is required. If used with
- * {@link WebSecurityConfigurerAdapter} a default login page will be generated when
- * this attribute is not specified.
+ * {@link EnableWebSecurity} a default login page will be generated when this
+ * attribute is not specified.
*
*
*
* If a URL is specified or this is not being used in conjunction with
- * {@link WebSecurityConfigurerAdapter}, users are required to process the specified
- * URL to generate a login page.
+ * {@link EnableWebSecurity}, users are required to process the specified URL to
+ * generate a login page.
*
*/
protected T loginPage(String loginPage) {
diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurer.java
index 95bea02fcf5..503851628d1 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurer.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurer.java
@@ -1,5 +1,5 @@
/*
- * Copyright 2002-2021 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -22,7 +22,7 @@
import javax.servlet.http.HttpServletRequest;
import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
import org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter;
@@ -30,7 +30,7 @@
/**
* Adds a Filter that will generate a login page if one is not specified otherwise when
- * using {@link WebSecurityConfigurerAdapter}.
+ * using {@link EnableWebSecurity}.
*
*
* By default an
@@ -64,7 +64,7 @@
*
* @author Rob Winch
* @since 3.2
- * @see WebSecurityConfigurerAdapter
+ * @see EnableWebSecurity
*/
public final class DefaultLoginPageConfigurer>
extends AbstractHttpConfigurer, H> {
diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/FormLoginConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/FormLoginConfigurer.java
index 32db2e8f16b..861288c2a5a 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/FormLoginConfigurer.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/FormLoginConfigurer.java
@@ -1,5 +1,5 @@
/*
- * Copyright 2002-2013 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -18,7 +18,7 @@
import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.authentication.ForwardAuthenticationFailureHandler;
import org.springframework.security.web.authentication.ForwardAuthenticationSuccessHandler;
@@ -84,15 +84,15 @@ public FormLoginConfigurer() {
/**
*
* Specifies the URL to send users to if login is required. If used with
- * {@link WebSecurityConfigurerAdapter} a default login page will be generated when
- * this attribute is not specified.
+ * {@link EnableWebSecurity} a default login page will be generated when this
+ * attribute is not specified.
*
*
*
* If a URL is specified or this is not being used in conjunction with
- * {@link WebSecurityConfigurerAdapter}, users are required to process the specified
- * URL to generate a login page. In general, the login page should create a form that
- * submits a request with the following requirements to work with
+ * {@link EnableWebSecurity}, users are required to process the specified URL to
+ * generate a login page. In general, the login page should create a form that submits
+ * a request with the following requirements to work with
* {@link UsernamePasswordAuthenticationFilter}:
*
*
diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/HeadersConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/HeadersConfigurer.java
index bd20c509536..3caa6e2d7e6 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/HeadersConfigurer.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/HeadersConfigurer.java
@@ -1,5 +1,5 @@
/*
- * Copyright 2002-2021 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -26,7 +26,7 @@
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.header.HeaderWriter;
import org.springframework.security.web.header.HeaderWriterFilter;
import org.springframework.security.web.header.writers.CacheControlHeadersWriter;
@@ -50,7 +50,7 @@
/**
*
* Adds the Security HTTP headers to the response. Security HTTP headers is activated by
- * default when using {@link WebSecurityConfigurerAdapter}'s default constructor.
+ * default when using {@link EnableWebSecurity}'s default constructor.
*
*
*
diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/RememberMeConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/RememberMeConfigurer.java
index ad4e1c082ba..0fd48f181df 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/RememberMeConfigurer.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/RememberMeConfigurer.java
@@ -22,10 +22,8 @@
import org.springframework.context.ApplicationContext;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.RememberMeAuthenticationProvider;
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
@@ -150,13 +148,10 @@ public RememberMeConfigurer useSecureCookie(boolean useSecureCookie) {
/**
* Specifies the {@link UserDetailsService} used to look up the {@link UserDetails}
- * when a remember me token is valid. The default is to use the
- * {@link UserDetailsService} found by invoking
- * {@link HttpSecurity#getSharedObject(Class)} which is set when using
- * {@link WebSecurityConfigurerAdapter#configure(AuthenticationManagerBuilder)}. When
- * using a {@link org.springframework.security.web.SecurityFilterChain} bean, the
- * default is to look for a {@link UserDetailsService} bean. Alternatively, one can
- * populate {@link #rememberMeServices(RememberMeServices)}.
+ * when a remember me token is valid. When using a
+ * {@link org.springframework.security.web.SecurityFilterChain} bean, the default is
+ * to look for a {@link UserDetailsService} bean. Alternatively, one can populate
+ * {@link #rememberMeServices(RememberMeServices)}.
* @param userDetailsService the {@link UserDetailsService} to configure
* @return the {@link RememberMeConfigurer} for further customization
* @see AbstractRememberMeServices
diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/X509Configurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/X509Configurer.java
index b557664d4d0..3309734cf0c 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/X509Configurer.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/X509Configurer.java
@@ -24,13 +24,11 @@
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.AuthenticationUserDetailsService;
import org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.AuthenticationEntryPoint;
-import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.Http403ForbiddenEntryPoint;
import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider;
import org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationToken;
@@ -144,10 +142,7 @@ public X509Configurer userDetailsService(UserDetailsService userDetailsServic
/**
* Specifies the {@link AuthenticationUserDetailsService} to use. If not specified,
- * the shared {@link UserDetailsService} will be used to create a
- * {@link UserDetailsByNameServiceWrapper}. If a {@link SecurityFilterChain} bean is
- * used instead of the {@link WebSecurityConfigurerAdapter}, then the
- * {@link UserDetailsService} bean will be used by default.
+ * then the {@link UserDetailsService} bean will be used by default.
* @param authenticationUserDetailsService the
* {@link AuthenticationUserDetailsService} to use
* @return the {@link X509Configurer} for further customizations
diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/openid/OpenIDLoginConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/openid/OpenIDLoginConfigurer.java
index 0d618ce01e8..5acc17bcf31 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/openid/OpenIDLoginConfigurer.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/openid/OpenIDLoginConfigurer.java
@@ -1,5 +1,5 @@
/*
- * Copyright 2002-2019 the original author or authors.
+ * Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -31,7 +31,7 @@
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractAuthenticationFilterConfigurer;
import org.springframework.security.config.annotation.web.configurers.FormLoginConfigurer;
import org.springframework.security.config.annotation.web.configurers.RememberMeConfigurer;
@@ -61,29 +61,29 @@
* Example Configuration
*
*
- *
* @Configuration
* @EnableWebSecurity
- * public class OpenIDLoginConfig extends WebSecurityConfigurerAdapter {
+ * public class OpenIDLoginConfig {
*
- * @Override
- * protected void configure(HttpSecurity http) {
+ * @Bean
+ * public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
* http
* .authorizeRequests()
* .antMatchers("/**").hasRole("USER")
* .and()
* .openidLogin()
* .permitAll();
+ * return http.build();
* }
*
- * @Override
- * protected void configure(AuthenticationManagerBuilder auth)(
- * AuthenticationManagerBuilder auth) throws Exception {
- * auth
- * .inMemoryAuthentication()
- * .withUser("https://www.google.com/accounts/o8/id?id=lmkCn9xzPdsxVwG7pjYMuDgNNdASFmobNkcRPaWU")
- * .password("password")
- * .roles("USER");
+ * @Bean
+ * public UserDetailsService userDetailsService() {
+ * UserDetails user = User.withDefaultPasswordEncoder()
+ * .username("https://www.google.com/accounts/o8/id?id=lmkCn9xzPdsxVwG7pjYMuDgNNdASFmobNkcRPaWU")
+ * .password("password")
+ * .roles("USER")
+ * .build();
+ * return new InMemoryUserDetailsManager(user);
* }
* }
*
@@ -229,14 +229,14 @@ public OpenIDLoginConfigurer loginProcessingUrl(String loginProcessingUrl) {
/**
*
* Specifies the URL to send users to if login is required. If used with
- * {@link WebSecurityConfigurerAdapter} a default login page will be generated when
- * this attribute is not specified.
+ * {@link EnableWebSecurity} a default login page will be generated when this
+ * attribute is not specified.
*
*
*
* If a URL is specified or this is not being used in conjunction with
- * {@link WebSecurityConfigurerAdapter}, users are required to process the specified
- * URL to generate a login page.
+ * {@link EnableWebSecurity}, users are required to process the specified URL to
+ * generate a login page.
*
*
*