14

What is the difference between those two? When do I use one over the other?

In the Spring Security Documentation it says that, among other things, WebMvcConfigurer has the following feature:

Require authentication to every URL in your application

The WebSecurityConfigurerAdapter example shown in HttpSecurity says:

Ensures that any request to our application requires the user to be authenticated.

Isn't that the same?

EDIT

These two types of configs seem to serve different purposes, I just don't quite understand yet, when to use which: What are the two distinct scenarios for each of the config types?

In the introduction to the HttpSecuriy section, it says

How does Spring Security know that we want to require all users to be authenticated? How does Spring Security know we want to support form based authentication?

So right now I am thinking: the first one says what should happen when authenticating a user and the second says in what cases do users need to be authenticated. Is that correct?

E.g., the first config "Generate a login form for you" and the second determines, when that login form should be shown?

0

1 Answer 1

4

This does appear to be a documentation bug (https://github.com/spring-projects/spring-security/issues/6809):

This raises confusion about the role of WebMvcConfigurer in Spring Security and the use cases for WebMvcConfigurer vs WebSecurityConfigurerAdapter.

Most likely the intention in the example was:

@EnableWebSecurity
public class WebSecurityConfig implements WebSecurityConfigurerAdapter {

instead of

@EnableWebSecurity
public class WebSecurityConfig implements WebMvcConfigurer {

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.