Spring Security 5.7: Equivalent of 'disableDefaults' from WebSecurityConfigurerAdapter for configuring HttpSecurity

Viewed 14

Since Spring Security 5.7 WebSecurityConfigurerAdapter was deprecated and it is now recommended to move towards a component-based security configuration (https://spring.io/blog/2022/02/21/spring-security-without-the-websecurityconfigureradapter).

Before my configuration looked somewhat similar to this:

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    public SecurityConfiguration() {
      // disables the defaults
      super(true);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            ...;
    }
}

The new recommended way would be something like:

@Configuration
public class SecurityConfiguration {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            ...;
    }

}

I have done a lot of reading migration articles, docs and the code, but so far I am missing the equivalent of the WebSecurityConfigurerAdapter#disableDefaults configuration.

0 Answers
Related