Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Configure WebSecurity using WebSecurityCustomizer

Browse Source 
Replace `WebSecurityConfigurer` and `WebSecurityConfigurerAdapter`
configurations with `WebSecurityCustomizer` or `SecurityFilterChain`
beans.

Closes gh-23421
This commit is contained in:
Madhura Bhave
2020-08-14 11:09:37 -07:00
committed by Phillip Webb
parent 79b98c9edd
commit 0818f27f44
20 changed files with 136 additions and 118 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
spring-boot-project/spring-boot-devtools/src/main/java/org/springframework/boot/devtools/autoconfigure/RemoteDevtoolsSecurityConfiguration.java
View File

@@ -19,10 +19,10 @@ package org.springframework.boot.devtools.autoconfigure;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.boot.autoconfigure.security.SecurityProperties;
import org.springframework.boot.autoconfigure.web.ServerProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
@@ -32,13 +32,12 @@ import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
*
* @author Madhura Bhave
*/
@ConditionalOnClass({ SecurityFilterChain.class, WebSecurityConfigurerAdapter.class })
@ConditionalOnClass({ SecurityFilterChain.class, HttpSecurity.class })
@Configuration(proxyBeanMethods = false)
class RemoteDevtoolsSecurityConfiguration {
@Order(SecurityProperties.BASIC_AUTH_ORDER - 1)
@Configuration
static class SecurityConfiguration extends WebSecurityConfigurerAdapter {
static class SecurityConfiguration {
private final String url;
@@ -48,10 +47,12 @@ class RemoteDevtoolsSecurityConfiguration {
this.url = servletContextPath + devToolsProperties.getRemote().getContextPath() + "/restart";
}
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
@Order(SecurityProperties.BASIC_AUTH_ORDER - 1)
SecurityFilterChain configure(HttpSecurity http) throws Exception {
http.requestMatcher(new AntPathRequestMatcher(this.url)).authorizeRequests().anyRequest().anonymous().and()
.csrf().disable();
return http.build();
}
}