Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Difference between WebMvcConfigurer and WebSecurityConfigurerAdapter

What is the difference between those two? When do I use one over the other?

In the Spring Security Documentation it says that, among other things, WebMvcConfigurer has the following feature:

Require authentication to every URL in your application

The WebSecurityConfigurerAdapter example shown in HttpSecurity says:

Ensures that any request to our application requires the user to be authenticated.

Isn't that the same?

EDIT

These two types of configs seem to serve different purposes, I just don't quite understand yet, when to use which: What are the two distinct scenarios for each of the config types?

In the introduction to the HttpSecuriy section, it says

How does Spring Security know that we want to require all users to be authenticated? How does Spring Security know we want to support form based authentication?

So right now I am thinking: the first one says what should happen when authenticating a user and the second says in what cases do users need to be authenticated. Is that correct?

E.g., the first config "Generate a login form for you" and the second determines, when that login form should be shown?

like image 845
user3629892 Avatar asked Dec 22 '18 09:12

user3629892


People also ask

What should I use instead of WebSecurityConfigurerAdapter?

You need to declare SecurityFilterChain and WebSecurityCustomizer beans instead of overriding methods of WebSecurityConfigurerAdapter class.

What is the use of WebSecurityConfigurerAdapter?

It allows configuring things that impact all of web security. WebSecurityConfigurerAdapter is a convenience class that allows customization to both WebSecurity and HttpSecurity. We can extend WebSecurityConfigurerAdapter multiple times (in distinct objects) to replicate the behavior of having multiple http elements.

What is the use of WebSecurityConfigurerAdapter in spring boot?

configure. Deprecated. Used by the default implementation of authenticationManager() to attempt to obtain an AuthenticationManager . If overridden, the AuthenticationManagerBuilder should be used to specify the AuthenticationManager .

Why do we use Webmvcconfigurer?

configureDefaultServletHandling. Configure a handler to delegate unhandled requests by forwarding to the Servlet container's "default" servlet. A common use case for this is when the DispatcherServlet is mapped to "/" thus overriding the Servlet container's default handling of static resources.


1 Answers

This does appear to be a documentation bug (https://github.com/spring-projects/spring-security/issues/6809):

This raises confusion about the role of WebMvcConfigurer in Spring Security and the use cases for WebMvcConfigurer vs WebSecurityConfigurerAdapter.

Most likely the intention in the example was:

@EnableWebSecurity
public class WebSecurityConfig implements WebSecurityConfigurerAdapter {

instead of

@EnableWebSecurity
public class WebSecurityConfig implements WebMvcConfigurer {
like image 195
peater Avatar answered Sep 21 '22 12:09

peater