Web security is an essential aspect of any web application, and it is crucial to keep it up-to-date with the latest best practices. One of the ways to secure a web application built with Spring is by using the WebSecurityConfigurerAdapter class. This class has been a powerful tool for developers, as it allows for fine-grained control over the application's security settings. However, starting with Spring Security 5.0, the WebSecurityConfigurerAdapter class has been deprecated in favor of a new approach using the SecurityFilterChain bean.
The old way of configuring security using WebSecurityConfigurerAdapter is a quite verbose and can be confusing for some developers. Let's take a look at an example of how it would look like:
In this example, we are defining two methods configure(AuthenticationManagerBuilder auth) and configure(HttpSecurity http). The first one is used to configure the authentication manager, and the second one is used to configure the authorization rules.
We can see that the configure(AuthenticationManagerBuilder auth) method is used to set up the UserDetailsService and PasswordEncoder to be used by the authentication manager.
The configure(HttpSecurity http) method is used to define the authorization rules. We can see that we are using antMatchers to match the requested URLs, and then we are using the hasRole method to define the role that is required to access those URLs.
As you can see, the old approach is quite verbose, and it can be difficult to understand for some developers. However, starting with Spring Security 5.0, a new approach has been introduced to configure security. The new approach uses the SecurityFilterChain bean, and it is more concise and easier to understand. Let's take a look at an example:
In this example, we are using the SecurityFilterChain bean to configure security. The SecurityFilterChain bean is a functional bean that allows for more flexibility in terms of configuring security settings.
So you only need to implement a single method, for whatever your embeded datasource, and make your config as we want.
Top comments (0)