SpringSecurity 2
SpringBootWebSecurityConfiguration is Spring Boot's internal class that sets up default web security, but in modern Spring Security (5.x+), you configure security by creating a SecurityFilterChain bean, replacing the older WebSecurityConfigurerAdapter for a more flexible, declarative approach where you define beans to customize filters (like CSRF, Basic Auth, Form Login) and request matching for different URL patterns (e.g., permitAll(), authenticated()). The SecurityFilterChain bean orchestrates these filters for processing incoming HTTP requests, making configuration modular and concise.
This video provides a visual introduction to the concept of a security filter chain:
Key Concepts
- SecurityFilterChain: A bean that defines a sequence (chain) of filters for handling security tasks (authentication, authorization, CSRF, etc.).
- HttpSecurity: An object used within the SecurityFilterChain bean's configuration to set up specific security features (e.g., .csrf(), .formLogin(), .authorizeHttpRequests()).
- Filter Chain: A series of filters (like CsrfFilter, BasicAuthenticationFilter, AuthorizationFilter) that process each request, each performing a specific security function.
Note : if you wnt to change the default behavior of securing all end points ... you need to change the method securityfilterchain( ) of class SpringbootWebSecurityConfiguration ... all you need to do is create your own "SecurityFilterChain"
package com.eazybytes.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import static org.springframework.security.config.Customizer.withDefaults;
@Configuration
public class ProjectSecurityConfig {
@Bean
SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) throws Exception {
/*http.authorizeHttpRequests((requests) -> requests.anyRequest().permitAll());*/
/*http.authorizeHttpRequests((requests) -> requests.anyRequest().denyAll());*/
http.authorizeHttpRequests((requests) -> requests
.requestMatchers("/myAccount", "/myBalance", "/myLoans", "/myCards").authenticated()
.requestMatchers("/notices", "/contact", "/error").permitAll());
http.formLogin(withDefaults());
http.httpBasic(withDefaults());
return http.build();
}
}
Defining Non Prod Users
Comments
Post a Comment