What is the difference between those two? When do I use one over the other?
In the Spring Security Documentation it says that, among other things, WebMvcConfigurer
has the following feature:
Require authentication to every URL in your application
The WebSecurityConfigurerAdapter
example shown in HttpSecurity says:
Ensures that any request to our application requires the user to be authenticated.
Isn't that the same?
EDIT
These two types of configs seem to serve different purposes, I just don't quite understand yet, when to use which: What are the two distinct scenarios for each of the config types?
In the introduction to the HttpSecuriy section, it says
How does Spring Security know that we want to require all users to be authenticated? How does Spring Security know we want to support form based authentication?
So right now I am thinking: the first one says what should happen when authenticating a user and the second says in what cases do users need to be authenticated. Is that correct?
E.g., the first config "Generate a login form for you" and the second determines, when that login form should be shown?
You need to declare SecurityFilterChain and WebSecurityCustomizer beans instead of overriding methods of WebSecurityConfigurerAdapter class.
It allows configuring things that impact all of web security. WebSecurityConfigurerAdapter is a convenience class that allows customization to both WebSecurity and HttpSecurity. We can extend WebSecurityConfigurerAdapter multiple times (in distinct objects) to replicate the behavior of having multiple http elements.
configure. Deprecated. Used by the default implementation of authenticationManager() to attempt to obtain an AuthenticationManager . If overridden, the AuthenticationManagerBuilder should be used to specify the AuthenticationManager .
configureDefaultServletHandling. Configure a handler to delegate unhandled requests by forwarding to the Servlet container's "default" servlet. A common use case for this is when the DispatcherServlet is mapped to "/" thus overriding the Servlet container's default handling of static resources.
This does appear to be a documentation bug (https://github.com/spring-projects/spring-security/issues/6809):
This raises confusion about the role of WebMvcConfigurer in Spring Security and the use cases for WebMvcConfigurer vs WebSecurityConfigurerAdapter.
Most likely the intention in the example was:
@EnableWebSecurity public class WebSecurityConfig implements WebSecurityConfigurerAdapter {
instead of
@EnableWebSecurity public class WebSecurityConfig implements WebMvcConfigurer {
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With