or run

npx @tessl/cli init
Log in

Version

Tile

Overview

Evals

Files

docs

authentication-configuration.mdcore-annotations.mdhttp-configurers.mdindex.mdmethod-security.mdoauth2-configuration.mdsecurity-builders.md
tile.json

tessl/maven-org-springframework-security--spring-security-config

Spring Security configuration module providing comprehensive declarative security configuration capabilities for Spring applications

Workspace
tessl
Visibility
Public
Created
Last updated
Describes
mavenpkg:maven/org.springframework.security/spring-security-config@6.5.x

To install, run

npx @tessl/cli install tessl/maven-org-springframework-security--spring-security-config@6.5.0

index.mddocs/

Spring Security Config

Spring Security Config provides comprehensive declarative security configuration capabilities for Spring applications. It offers annotation-based configuration, fluent builders, and specialized configurers to define authentication, authorization, and security policies without programmatic filter chain construction.

Package Information

  • Package Name: org.springframework.security:spring-security-config
  • Package Type: Maven/Gradle
  • Language: Java
  • Version: 6.5.1
  • Installation: 
    <dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-config</artifactId>
  <version>6.5.1</version>
</dependency>

Core Imports

import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;

Basic Usage

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .permitAll()
            )
            .logout(logout -> logout.permitAll())
            .build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

Architecture

Spring Security Config uses a layered architecture:

  1. Annotations - Enable security features and import configuration classes
  2. Builders - Provide fluent APIs for constructing security objects
  3. Configurers - Specialized components for specific security features
  4. Infrastructure - Base classes and utilities supporting the configuration system

The module integrates with Spring's dependency injection container and follows the builder pattern for configuration flexibility.

Capabilities

Core Security Annotations

Essential annotations for enabling and configuring Spring Security features.

@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
@Import({WebSecurityConfiguration.class, SpringWebMvcImportSelector.class, 
         OAuth2ImportSelector.class, HttpSecurityConfiguration.class})
@EnableGlobalAuthentication
public @interface EnableWebSecurity {
    boolean debug() default false;
}
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
@Import(MethodSecurityConfiguration.class)
public @interface EnableMethodSecurity {
    boolean prePostEnabled() default true;
    boolean securedEnabled() default false;
    boolean jsr250Enabled() default false;
    boolean proxyTargetClass() default false;
    AdviceMode mode() default AdviceMode.PROXY;
    int offset() default 0;
}
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
@Import(ReactiveMethodSecurityConfiguration.class)
public @interface EnableReactiveMethodSecurity {
    boolean proxyTargetClass() default false;
    AdviceMode mode() default AdviceMode.PROXY;
    int order() default Ordered.LOWEST_PRECEDENCE;
    boolean useAuthorizationManager() default true;
}
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
@Import({ServerHttpSecurityConfiguration.class, WebFluxSecurityConfiguration.class, 
         ReactiveOAuth2ClientImportSelector.class, ReactiveObservationImportSelector.class})
public @interface EnableWebFluxSecurity {
}
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
@Import({WebSocketMessageBrokerSecurityConfiguration.class, WebSocketObservationImportSelector.class})
public @interface EnableWebSocketSecurity {
}
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
@Import({RSocketSecurityConfiguration.class, SecuritySocketAcceptorInterceptorConfiguration.class, 
         ReactiveObservationImportSelector.class})
public @interface EnableRSocketSecurity {
}
/** @deprecated Use @EnableMethodSecurity instead */
@Deprecated
@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
@Import(GlobalMethodSecurityConfiguration.class)
public @interface EnableGlobalMethodSecurity {
    boolean prePostEnabled() default false;
    boolean securedEnabled() default false;
    boolean jsr250Enabled() default false;
    boolean proxyTargetClass() default false;
    AdviceMode mode() default AdviceMode.PROXY;
    int order() default Ordered.LOWEST_PRECEDENCE;
}

Core Security Annotations

Security Builder Classes

Fluent API builders for constructing security configuration objects.

public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<DefaultSecurityFilterChain, HttpSecurity>
        implements SecurityBuilder<DefaultSecurityFilterChain>, HttpSecurityBuilder<HttpSecurity> {
    
    // Authorization Configuration
    public AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry authorizeHttpRequests();
    public AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry authorizeHttpRequests(
            Customizer<AuthorizeHttpRequestsConfigurer<HttpSecurity>.AuthorizationManagerRequestMatcherRegistry> authorizeHttpRequestsCustomizer);
    
    /** @deprecated Use authorizeHttpRequests() instead */
    @Deprecated
    public ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry authorizeRequests();
    /** @deprecated Use authorizeHttpRequests() instead */
    @Deprecated
    public ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry authorizeRequests(
            Customizer<ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry> authorizeRequestsCustomizer);
    
    // Authentication Methods
    public FormLoginConfigurer<HttpSecurity> formLogin();
    public FormLoginConfigurer<HttpSecurity> formLogin(Customizer<FormLoginConfigurer<HttpSecurity>> formLoginCustomizer);
    public HttpBasicConfigurer<HttpSecurity> httpBasic();
    public HttpBasicConfigurer<HttpSecurity> httpBasic(Customizer<HttpBasicConfigurer<HttpSecurity>> httpBasicCustomizer);
    public OAuth2LoginConfigurer<HttpSecurity> oauth2Login();
    public OAuth2LoginConfigurer<HttpSecurity> oauth2Login(Customizer<OAuth2LoginConfigurer<HttpSecurity>> oauth2LoginCustomizer);
    public OAuth2ClientConfigurer<HttpSecurity> oauth2Client();
    public OAuth2ClientConfigurer<HttpSecurity> oauth2Client(Customizer<OAuth2ClientConfigurer<HttpSecurity>> oauth2ClientCustomizer);
    public OAuth2ResourceServerConfigurer<HttpSecurity> oauth2ResourceServer();
    public OAuth2ResourceServerConfigurer<HttpSecurity> oauth2ResourceServer(Customizer<OAuth2ResourceServerConfigurer<HttpSecurity>> oauth2ResourceServerCustomizer);
    public Saml2LoginConfigurer<HttpSecurity> saml2Login();
    public Saml2LoginConfigurer<HttpSecurity> saml2Login(Customizer<Saml2LoginConfigurer<HttpSecurity>> saml2LoginCustomizer);
    public Saml2LogoutConfigurer<HttpSecurity> saml2Logout();
    public Saml2LogoutConfigurer<HttpSecurity> saml2Logout(Customizer<Saml2LogoutConfigurer<HttpSecurity>> saml2LogoutCustomizer);
    public Saml2MetadataConfigurer<HttpSecurity> saml2Metadata();
    public Saml2MetadataConfigurer<HttpSecurity> saml2Metadata(Customizer<Saml2MetadataConfigurer<HttpSecurity>> saml2MetadataCustomizer);
    public OidcLogoutConfigurer<HttpSecurity> oidcLogout();
    public OidcLogoutConfigurer<HttpSecurity> oidcLogout(Customizer<OidcLogoutConfigurer<HttpSecurity>> oidcLogoutCustomizer);
    public OneTimeTokenLoginConfigurer<HttpSecurity> oneTimeTokenLogin();
    public OneTimeTokenLoginConfigurer<HttpSecurity> oneTimeTokenLogin(Customizer<OneTimeTokenLoginConfigurer<HttpSecurity>> oneTimeTokenLoginCustomizer);
    public WebAuthnConfigurer<HttpSecurity> webAuthn(Customizer<WebAuthnConfigurer<HttpSecurity>> webAuthnCustomizer);
    public X509Configurer<HttpSecurity> x509();
    public X509Configurer<HttpSecurity> x509(Customizer<X509Configurer<HttpSecurity>> x509Customizer);
    public JeeConfigurer<HttpSecurity> jee();
    public JeeConfigurer<HttpSecurity> jee(Customizer<JeeConfigurer<HttpSecurity>> jeeCustomizer);
    public RememberMeConfigurer<HttpSecurity> rememberMe();
    public RememberMeConfigurer<HttpSecurity> rememberMe(Customizer<RememberMeConfigurer<HttpSecurity>> rememberMeCustomizer);
    public AnonymousConfigurer<HttpSecurity> anonymous();
    public AnonymousConfigurer<HttpSecurity> anonymous(Customizer<AnonymousConfigurer<HttpSecurity>> anonymousCustomizer);
    
    // Session and Security Context Management
    public SessionManagementConfigurer<HttpSecurity> sessionManagement();
    public SessionManagementConfigurer<HttpSecurity> sessionManagement(Customizer<SessionManagementConfigurer<HttpSecurity>> sessionManagementCustomizer);
    public SecurityContextConfigurer<HttpSecurity> securityContext();
    public SecurityContextConfigurer<HttpSecurity> securityContext(Customizer<SecurityContextConfigurer<HttpSecurity>> securityContextCustomizer);
    
    // Security Features
    public CsrfConfigurer<HttpSecurity> csrf();
    public CsrfConfigurer<HttpSecurity> csrf(Customizer<CsrfConfigurer<HttpSecurity>> csrfCustomizer);
    public CorsConfigurer<HttpSecurity> cors();
    public CorsConfigurer<HttpSecurity> cors(Customizer<CorsConfigurer<HttpSecurity>> corsCustomizer);
    public HeadersConfigurer<HttpSecurity> headers();
    public HeadersConfigurer<HttpSecurity> headers(Customizer<HeadersConfigurer<HttpSecurity>> headersCustomizer);
    public LogoutConfigurer<HttpSecurity> logout();
    public LogoutConfigurer<HttpSecurity> logout(Customizer<LogoutConfigurer<HttpSecurity>> logoutCustomizer);
    public RequireChannelConfigurer<HttpSecurity> requiresChannel();
    public RequireChannelConfigurer<HttpSecurity> requiresChannel(Customizer<RequireChannelConfigurer<HttpSecurity>> requiresChannelCustomizer);
    public HttpSecurity redirectToHttps();
    public PasswordManagementConfigurer<HttpSecurity> passwordManagement(Customizer<PasswordManagementConfigurer<HttpSecurity>> passwordManagementCustomizer);
    
    // Exception and Request Handling
    public ExceptionHandlingConfigurer<HttpSecurity> exceptionHandling();
    public ExceptionHandlingConfigurer<HttpSecurity> exceptionHandling(Customizer<ExceptionHandlingConfigurer<HttpSecurity>> exceptionHandlingCustomizer);
    public RequestCacheConfigurer<HttpSecurity> requestCache();
    public RequestCacheConfigurer<HttpSecurity> requestCache(Customizer<RequestCacheConfigurer<HttpSecurity>> requestCacheCustomizer);
    
    // Security Matchers and Configuration
    public SecurityMatcher securityMatchers();
    public SecurityMatcher securityMatchers(Customizer<SecurityMatcher> securityMatcherCustomizer);
    public HttpSecurity securityMatcher(RequestMatcher requestMatcher);
    public HttpSecurity securityMatcher(String... patterns);
    
    // Authentication Infrastructure
    public HttpSecurity authenticationManager(AuthenticationManager authenticationManager);
    public HttpSecurity authenticationProvider(AuthenticationProvider authenticationProvider);
    public HttpSecurity userDetailsService(UserDetailsService userDetailsService);
    
    // Filter Management
    public HttpSecurity addFilter(Filter filter);
    public HttpSecurity addFilterAfter(Filter filter, Class<? extends Filter> afterFilter);
    public HttpSecurity addFilterBefore(Filter filter, Class<? extends Filter> beforeFilter);
    public HttpSecurity addFilterAt(Filter filter, Class<? extends Filter> atFilter);
    
    // Final Build
    public DefaultSecurityFilterChain build() throws Exception;
}
public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter, WebSecurity>
        implements SecurityBuilder<Filter> {
    
    public WebSecurity ignoring();
    public WebSecurity debug(boolean debugEnabled);
    public WebSecurity httpFirewall(HttpFirewall httpFirewall);
    public Filter build() throws Exception;
}

Security Builder Classes

HTTP Security Configurers

Specialized configurers for authentication, authorization, and security protection.

public final class FormLoginConfigurer<H extends HttpSecurityBuilder<H>> 
        extends AbstractAuthenticationFilterConfigurer<H, FormLoginConfigurer<H>, UsernamePasswordAuthenticationFilter> {
    
    public FormLoginConfigurer<H> loginPage(String loginPage);
    public FormLoginConfigurer<H> defaultSuccessUrl(String defaultSuccessUrl);
    public FormLoginConfigurer<H> failureUrl(String authenticationFailureUrl);
    public FormLoginConfigurer<H> usernameParameter(String usernameParameter);
    public FormLoginConfigurer<H> passwordParameter(String passwordParameter);
}
public final class AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>> 
        extends AbstractRequestMatcherRegistry<AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry> {
    
    public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry requestMatchers(String... patterns);
    public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry requestMatchers(HttpMethod method, String... patterns);
    public AuthorizeHttpRequestsConfigurer<H>.AuthorizationManagerRequestMatcherRegistry anyRequest();
}

HTTP Security Configurers

OAuth2 and SAML2 Configuration

Modern authentication protocol configuration support.

public final class OAuth2LoginConfigurer<H extends HttpSecurityBuilder<H>> 
        extends AbstractAuthenticationFilterConfigurer<H, OAuth2LoginConfigurer<H>, OAuth2LoginAuthenticationFilter> {
    
    public OAuth2LoginConfigurer<H> clientRegistrationRepository(ClientRegistrationRepository clientRegistrationRepository);
    public OAuth2LoginConfigurer<H> authorizedClientService(OAuth2AuthorizedClientService authorizedClientService);
    public OAuth2LoginConfigurer<H> userInfoEndpoint(Customizer<UserInfoEndpointConfig> userInfoEndpointCustomizer);
}
public final class OAuth2ResourceServerConfigurer<H extends HttpSecurityBuilder<H>> 
        extends AbstractHttpConfigurer<OAuth2ResourceServerConfigurer<H>, H> {
    
    public OAuth2ResourceServerConfigurer<H> jwt(Customizer<JwtConfigurer> jwtCustomizer);
    public OAuth2ResourceServerConfigurer<H> opaqueToken(Customizer<OpaqueTokenConfigurer> opaqueTokenCustomizer);
    public OAuth2ResourceServerConfigurer<H> bearerTokenResolver(BearerTokenResolver bearerTokenResolver);
}

OAuth2 and SAML2 Configuration

Authentication Configuration

User details services, authentication providers, and authentication managers.

public class AuthenticationManagerBuilder 
        extends AbstractConfiguredSecurityBuilder<AuthenticationManager, AuthenticationManagerBuilder>
        implements ProviderManagerBuilder<AuthenticationManagerBuilder> {
    
    public InMemoryUserDetailsManagerConfigurer<AuthenticationManagerBuilder> inMemoryAuthentication();
    public JdbcUserDetailsManagerConfigurer<AuthenticationManagerBuilder> jdbcAuthentication();
    public LdapAuthenticationProviderConfigurer<AuthenticationManagerBuilder> ldapAuthentication();
    public DaoAuthenticationConfigurer<AuthenticationManagerBuilder, InMemoryUserDetailsManager> userDetailsService(UserDetailsService userDetailsService);
    public AuthenticationManagerBuilder authenticationProvider(AuthenticationProvider authenticationProvider);
}

Authentication Configuration

Method Security

Annotation-based method-level security configuration.

@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
@Import(ReactiveMethodSecurityConfiguration.class)
public @interface EnableReactiveMethodSecurity {
    boolean proxyTargetClass() default false;
    AdviceMode mode() default AdviceMode.PROXY;
    int order() default Ordered.LOWEST_PRECEDENCE;
    boolean useAuthorizationManager() default true;
}
public abstract class GlobalMethodSecurityConfiguration implements ImportAware, BeanClassLoaderAware {
    protected void configure(AuthenticationManagerBuilder auth) throws Exception;
    protected AccessDecisionManager accessDecisionManager();
    protected MethodSecurityExpressionHandler createExpressionHandler();
}

Method Security Configuration

Types

Core Configuration Types

public interface SecurityBuilder<O> {
    O build() throws Exception;
}
public interface SecurityConfigurer<O, B extends SecurityBuilder<O>> {
    void init(B builder) throws Exception;
    void configure(B builder) throws Exception;
}
public abstract class SecurityConfigurerAdapter<O, B extends SecurityBuilder<O>> 
        implements SecurityConfigurer<O, B> {
    public void init(B builder) throws Exception;
    public void configure(B builder) throws Exception;
    public B and();
    protected final O postProcess(O object);
}

Customization Support

@FunctionalInterface
public interface Customizer<T> {
    void customize(T t);
    
    static <T> Customizer<T> withDefaults() {
        return (t) -> {};
    }
}
public interface ObjectPostProcessor<T> {
    <O extends T> O postProcess(O object);
}

Constants

public final class BeanIds {
    public static final String AUTHENTICATION_MANAGER = "org.springframework.security.authenticationManager";
    public static final String SPRING_SECURITY_FILTER_CHAIN = "org.springframework.security.filterChain";
    public static final String USER_DETAILS_SERVICE = "org.springframework.security.userDetailsService";
    public static final String FILTER_CHAIN_PROXY = "org.springframework.security.web.FilterChainProxy";
}