Spring Security Configuration - HttpSecurity vs WebSecurity

Question

I just need to understand something in Spring Security Configuration. Using the example below...

@Configuration public class SecurityConfig extends WebSecurityConfigurerAdapter {      @Override     protected void configure(HttpSecurity http) throws Exception {         http             .httpBasic()             .and()             .authorizeRequests().antMatchers("/secret/**").authenticated()             .and()             .authorizeRequests().antMatchers("/**").permitAll();     }      @Override     public void configure(WebSecurity web) throws Exception {         web.ignoring().antMatchers("/resources/**");     }  } 

What is the purpose of configure(WebSecurity web) method?

Can't I just add /resources/** in the configure(HttpSecurity http) method in this line .authorizeRequests().antMatchers("/**", "/resources/**").permitAll(); Shouldn't it work the same i.e. permitting all requests to /resources/** without any authentication?

Answer 1

General use of WebSecurity ignoring() method omits Spring Security and none of Spring Security’s features will be available. WebSecurity is based above HttpSecurity.

@Override public void configure(WebSecurity web) throws Exception {     web         .ignoring()         .antMatchers("/resources/**")         .antMatchers("/publics/**"); }  @Override protected void configure(HttpSecurity http) throws Exception {     http         .authorizeRequests()         .antMatchers("/admin/**").hasRole("ADMIN")         .antMatchers("/publics/**").hasRole("USER") // no effect         .anyRequest().authenticated(); } 

WebSecurity in the above example lets Spring ignore /resources/** and /publics/**. Therefore the .antMatchers("/publics/**").hasRole("USER") in HttpSecurity is unconsidered.

This will omit the request pattern from the security filter chain entirely. Note that anything matching this path will then have no authentication or authorization services applied and will be freely accessible.

configure(HttpSecurity) allows configuration of web-based security at a resource level, based on a selection match - e.g. The example below restricts the URLs that start with /admin/ to users that have ADMIN role, and declares that any other URLs need to be successfully authenticated.

configure(WebSecurity) is used for configuration settings that impact global security (ignore resources, set debug mode, reject requests by implementing a custom firewall definition). For example, the following method would cause any request that starts with /resources/ to be ignored for authentication purposes.

---

Let's consider the below code, we can ignore the authentication for the endpoint provided within antMatchers using both the methods.

@Override public void configure(WebSecurity web) throws Exception {     web         .ignoring()         .antMatchers("/login", "/register", "/api/public/**"); }  @Override public void configure(HttpSecurity http) throws Exception {      http         .csrf().disable()         .authorizeRequests()         .antMatchers("/login", "/register", "/api/public/**").permitAll()         .anyRequest().authenticated(); } 

• configure(WebSecurity web) Endpoint used in this method ignores the spring security filters, security features (secure headers, csrf protection etc) are also ignored and no security context will be set and can not protect endpoints for Cross-Site Scripting, XSS attacks, content-sniffing.

• configure(HttpSecurity http) Endpoint used in this method ignores the authentication for endpoints used in antMatchers and other security features will be in effect such as secure headers, CSRF protection, etc.

Answer 2

When you use HttpSecurity and try to permitAll() requests. Your requests will be allowed to be accessed from the Spring Security Filter Chain. This is costly as there will be requests other requests which would also come into this filter chain which needs to be allowed or disallowed based on Authentication/Authorization.

HttpSecurity.authorizeRequests().antMatchers("/**", "/resources/**").permitAll(); 

But when you use, any requests to resources will completely by pass the Spring Security Filter Chain all together. It is safe because you don't need any Authentication/Authorization to be in place to see an image or read a javascript file.

WebSecurity.ignoring().antMatchers("/resources/**");