Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Replace WebSecurityConfigurerAdapter with SecurityFilterChain in docs

Browse Source 
Closes gh-10003
This commit is contained in:
Eleftheria Stein
2022-02-08 16:12:10 +01:00
parent 84616543a3
commit 4142f06259
22 changed files with 622 additions and 444 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
docs/modules/ROOT/pages/servlet/configuration/java.adoc
View File

@@ -144,19 +144,21 @@ public class MvcWebApplicationInitializer extends
Thus far, our <<jc-hello-wsca,`WebSecurityConfig`>> contains only information about how to authenticate our users.
How does Spring Security know that we want to require all users to be authenticated?
How does Spring Security know we want to support form-based authentication?
Actually, there is a configuration class (called `WebSecurityConfigurerAdapter`) that is being invoked behind the scenes.
It has a method called `configure` with the following default implementation:
Actually, there is a configuration class (called `SecurityFilterChain`) that is being invoked behind the scenes.
It is configured with the following default implementation:
====
[source,java]
----
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeRequests(authorize -> authorize
.anyRequest().authenticated()
)
.formLogin(withDefaults())
.httpBasic(withDefaults());
return http.build();
}
----
====
@@ -183,7 +185,7 @@ Note that this configuration is parallels the XML Namespace configuration:
== Multiple HttpSecurity Instances
We can configure multiple `HttpSecurity` instances just as we can have multiple `<http>` blocks in XML.
The key is to extend the `WebSecurityConfigurerAdapter` multiple times.
The key is to register multiple `SecurityFilterChain` `@Bean`s.
The following example has a different configuration for URL's that start with `/api/`.
====
@@ -201,39 +203,35 @@ public class MultiHttpSecurityConfig {
return manager;
}
@Configuration
@Bean
@Order(1) <2>
public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
protected void configure(HttpSecurity http) throws Exception {
http
.antMatcher("/api/**") <3>
.authorizeHttpRequests(authorize -> authorize
.anyRequest().hasRole("ADMIN")
)
.httpBasic(withDefaults());
}
public SecurityFilterChain apiFilterChain(HttpSecurity http) throws Exception {
http
.antMatcher("/api/**") <3>
.authorizeHttpRequests(authorize -> authorize
.anyRequest().hasRole("ADMIN")
)
.httpBasic(withDefaults());
return http.build();
}
@Configuration <4>
public static class FormLoginWebSecurityConfigurerAdapter extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
)
.formLogin(withDefaults());
}
@Bean <4>
public SecurityFilterChain formLoginFilterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
)
.formLogin(withDefaults());
return http.build();
}
}
----
<1> Configure Authentication as usual.
<2> Create an instance of `WebSecurityConfigurerAdapter` that contains `@Order` to specify which `WebSecurityConfigurerAdapter` should be considered first.
<2> Create an instance of `SecurityFilterChain` that contains `@Order` to specify which `SecurityFilterChain` should be considered first.
<3> The `http.antMatcher` states that this `HttpSecurity` is applicable only to URLs that start with `/api/`.
<4> Create another instance of `WebSecurityConfigurerAdapter`.
<4> Create another instance of `SecurityFilterChain`.
If the URL does not start with `/api/`, this configuration is used.
This configuration is considered after `ApiWebSecurityConfigurationAdapter`, since it has an `@Order` value after `1` (no `@Order` defaults to last).
This configuration is considered after `apiFilterChain`, since it has an `@Order` value after `1` (no `@Order` defaults to last).
====
[[jc-custom-dsls]]
@@ -287,14 +285,15 @@ You can then use the custom DSL:
[source,java]
----
@EnableWebSecurity
public class Config extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
public class Config {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.apply(customDsl())
.flag(true)
.and()
...;
return http.build();
}
}
----
@@ -306,7 +305,7 @@ The code is invoked in the following order:
* Code in the `MyCustomDsl.init` method is invoked
* Code in the `MyCustomDsl.configure` method is invoked
If you want, you can have `WebSecurityConfigurerAdapter` add `MyCustomDsl` by default by using `SpringFactories`.
If you want, you can have `HttpSecurity` add `MyCustomDsl` by default by using `SpringFactories`.
For example, you can create a resource on the classpath named `META-INF/spring.factories` with the following contents:
.META-INF/spring.factories
@@ -323,12 +322,13 @@ You can also explicit disable the default:
[source,java]
----
@EnableWebSecurity
public class Config extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
public class Config {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.apply(customDsl()).disable()
...;
return http.build();
}
}
----
@@ -348,8 +348,8 @@ For example, to configure the `filterSecurityPublishAuthorizationSuccess` proper
====
[source,java]
----
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeRequests(authorize -> authorize
.anyRequest().authenticated()
@@ -361,6 +361,7 @@ protected void configure(HttpSecurity http) throws Exception {
}
})
);
return http.build();
}
----
====