HttpSecurity (spring-security-docs-manual 5.3.2.RELEASE API)

java.lang.Object
- org.springframework.security.config.annotation.AbstractSecurityBuilder<O>
- - org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder<DefaultSecurityFilterChain,HttpSecurity>
  - - org.springframework.security.config.annotation.web.builders.HttpSecurity

All Implemented Interfaces:

SecurityBuilder<DefaultSecurityFilterChain>, HttpSecurityBuilder<HttpSecurity>
```
public final class HttpSecurity
extends AbstractConfiguredSecurityBuilder<DefaultSecurityFilterChain,HttpSecurity>
implements SecurityBuilder<DefaultSecurityFilterChain>, HttpSecurityBuilder<HttpSecurity>
```
A HttpSecurity is similar to Spring Security's XML <http> element in the namespace configuration. It allows configuring web based security for specific http requests. By default it will be applied to all requests, but can be restricted using requestMatcher(RequestMatcher) or other similar methods.
Example Usage
The most basic form based configuration can be seen below. The configuration will require that any URL that is requested will require a User with the role "ROLE_USER". It also defines an in memory authentication scheme with a user that has the username "user", the password "password", and the role "ROLE_USER". For additional examples, refer to the Java Doc of individual methods on HttpSecurity.
```
 @Configuration
 @EnableWebSecurity
 public class FormLoginSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin();
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
        }
 }
 
```
Since:

3.2

See Also:

EnableWebSecurity

Nested Class Summary

Nested Classes
Modifier and Type	Class and Description
`class`	`HttpSecurity.MvcMatchersRequestMatcherConfigurer` An extension to `HttpSecurity.RequestMatcherConfigurer` that allows optionally configuring the servlet path.
`class`	`HttpSecurity.RequestMatcherConfigurer` Allows mapping HTTP requests that this `HttpSecurity` will be used for

Constructor Summary

Constructors
Constructor and Description
`HttpSecurity(ObjectPostProcessor<java.lang.Object> objectPostProcessor, AuthenticationManagerBuilder authenticationBuilder, java.util.Map<java.lang.Class<?>,java.lang.Object> sharedObjects)` Creates a new instance

Method Summary

All Methods Instance Methods Concrete Methods
Modifier and Type	Method and Description
`HttpSecurity`	`addFilter(javax.servlet.Filter filter)` Adds a `Filter` that must be an instance of or extend one of the Filters provided within the Security framework.
`HttpSecurity`	`addFilterAfter(javax.servlet.Filter filter, java.lang.Class<? extends javax.servlet.Filter> afterFilter)` Allows adding a `Filter` after one of the known `Filter` classes.
`HttpSecurity`	`addFilterAt(javax.servlet.Filter filter, java.lang.Class<? extends javax.servlet.Filter> atFilter)` Adds the Filter at the location of the specified Filter class.
`HttpSecurity`	`addFilterBefore(javax.servlet.Filter filter, java.lang.Class<? extends javax.servlet.Filter> beforeFilter)` Allows adding a `Filter` before one of the known `Filter` classes.
`AnonymousConfigurer<HttpSecurity>`	`anonymous()` Allows configuring how an anonymous user is represented.
`HttpSecurity`	`anonymous(Customizer<AnonymousConfigurer<HttpSecurity>> anonymousCustomizer)` Allows configuring how an anonymous user is represented.
`HttpSecurity`	`antMatcher(java.lang.String antPattern)` Allows configuring the `HttpSecurity` to only be invoked when matching the provided ant pattern.
`HttpSecurity`	`authenticationProvider(AuthenticationProvider authenticationProvider)` Allows adding an additional `AuthenticationProvider` to be used
`ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrlRegistry`	`authorizeRequests()` Allows restricting access based upon the `HttpServletRequest` using `RequestMatcher` implementations (i.e.
`HttpSecurity`	`authorizeRequests(Customizer<ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrlRegistry> authorizeRequestsCustomizer)` Allows restricting access based upon the `HttpServletRequest` using `RequestMatcher` implementations (i.e.
`protected void`	`beforeConfigure()` Invoked prior to invoking each `SecurityConfigurer.configure(SecurityBuilder)` method.
`CorsConfigurer<HttpSecurity>`	`cors()` Adds a `CorsFilter` to be used.
`HttpSecurity`	`cors(Customizer<CorsConfigurer<HttpSecurity>> corsCustomizer)` Adds a `CorsFilter` to be used.
`CsrfConfigurer<HttpSecurity>`	`csrf()` Adds CSRF support.
`HttpSecurity`	`csrf(Customizer<CsrfConfigurer<HttpSecurity>> csrfCustomizer)` Adds CSRF support.
`ExceptionHandlingConfigurer<HttpSecurity>`	`exceptionHandling()` Allows configuring exception handling.
`HttpSecurity`	`exceptionHandling(Customizer<ExceptionHandlingConfigurer<HttpSecurity>> exceptionHandlingCustomizer)` Allows configuring exception handling.
`FormLoginConfigurer<HttpSecurity>`	`formLogin()` Specifies to support form based authentication.
`HttpSecurity`	`formLogin(Customizer<FormLoginConfigurer<HttpSecurity>> formLoginCustomizer)` Specifies to support form based authentication.
`HeadersConfigurer<HttpSecurity>`	`headers()` Adds the Security headers to the response.
`HttpSecurity`	`headers(Customizer<HeadersConfigurer<HttpSecurity>> headersCustomizer)` Adds the Security headers to the response.
`HttpBasicConfigurer<HttpSecurity>`	`httpBasic()` Configures HTTP Basic authentication.
`HttpSecurity`	`httpBasic(Customizer<HttpBasicConfigurer<HttpSecurity>> httpBasicCustomizer)` Configures HTTP Basic authentication.
`JeeConfigurer<HttpSecurity>`	`jee()` Configures container based pre authentication.
`HttpSecurity`	`jee(Customizer<JeeConfigurer<HttpSecurity>> jeeCustomizer)` Configures container based pre authentication.
`LogoutConfigurer<HttpSecurity>`	`logout()` Provides logout support.
`HttpSecurity`	`logout(Customizer<LogoutConfigurer<HttpSecurity>> logoutCustomizer)` Provides logout support.
`HttpSecurity`	`mvcMatcher(java.lang.String mvcPattern)` Allows configuring the `HttpSecurity` to only be invoked when matching the provided Spring MVC pattern.
`OAuth2ClientConfigurer<HttpSecurity>`	`oauth2Client()` Configures OAuth 2.0 Client support.
`HttpSecurity`	`oauth2Client(Customizer<OAuth2ClientConfigurer<HttpSecurity>> oauth2ClientCustomizer)` Configures OAuth 2.0 Client support.
`OAuth2LoginConfigurer<HttpSecurity>`	`oauth2Login()` Configures authentication support using an OAuth 2.0 and/or OpenID Connect 1.0 Provider.
`HttpSecurity`	`oauth2Login(Customizer<OAuth2LoginConfigurer<HttpSecurity>> oauth2LoginCustomizer)` Configures authentication support using an OAuth 2.0 and/or OpenID Connect 1.0 Provider.
`OAuth2ResourceServerConfigurer<HttpSecurity>`	`oauth2ResourceServer()` Configures OAuth 2.0 Resource Server support.
`HttpSecurity`	`oauth2ResourceServer(Customizer<OAuth2ResourceServerConfigurer<HttpSecurity>> oauth2ResourceServerCustomizer)` Configures OAuth 2.0 Resource Server support.
`OpenIDLoginConfigurer<HttpSecurity>`	`openidLogin()` Allows configuring OpenID based authentication.
`HttpSecurity`	`openidLogin(Customizer<OpenIDLoginConfigurer<HttpSecurity>> openidLoginCustomizer)` Allows configuring OpenID based authentication.
`protected DefaultSecurityFilterChain`	`performBuild()` Subclasses must implement this method to build the object that is being returned.
`PortMapperConfigurer<HttpSecurity>`	`portMapper()` Allows configuring a `PortMapper` that is available from `AbstractConfiguredSecurityBuilder.getSharedObject(Class)`.
`HttpSecurity`	`portMapper(Customizer<PortMapperConfigurer<HttpSecurity>> portMapperCustomizer)` Allows configuring a `PortMapper` that is available from `AbstractConfiguredSecurityBuilder.getSharedObject(Class)`.
`HttpSecurity`	`regexMatcher(java.lang.String pattern)` Allows configuring the `HttpSecurity` to only be invoked when matching the provided regex pattern.
`RememberMeConfigurer<HttpSecurity>`	`rememberMe()` Allows configuring of Remember Me authentication.
`HttpSecurity`	`rememberMe(Customizer<RememberMeConfigurer<HttpSecurity>> rememberMeCustomizer)` Allows configuring of Remember Me authentication.
`RequestCacheConfigurer<HttpSecurity>`	`requestCache()` Allows configuring the Request Cache.
`HttpSecurity`	`requestCache(Customizer<RequestCacheConfigurer<HttpSecurity>> requestCacheCustomizer)` Allows configuring the Request Cache.
`HttpSecurity`	`requestMatcher(RequestMatcher requestMatcher)` Allows configuring the `HttpSecurity` to only be invoked when matching the provided `RequestMatcher`.
`HttpSecurity.RequestMatcherConfigurer`	`requestMatchers()` Allows specifying which `HttpServletRequest` instances this `HttpSecurity` will be invoked on.
`HttpSecurity`	`requestMatchers(Customizer<HttpSecurity.RequestMatcherConfigurer> requestMatcherCustomizer)` Allows specifying which `HttpServletRequest` instances this `HttpSecurity` will be invoked on.
`ChannelSecurityConfigurer.ChannelRequestMatcherRegistry`	`requiresChannel()` Configures channel security.
`HttpSecurity`	`requiresChannel(Customizer<ChannelSecurityConfigurer.ChannelRequestMatcherRegistry> requiresChannelCustomizer)` Configures channel security.
`Saml2LoginConfigurer<HttpSecurity>`	`saml2Login()` Configures authentication support using an SAML 2.0 Service Provider.
`HttpSecurity`	`saml2Login(Customizer<Saml2LoginConfigurer<HttpSecurity>> saml2LoginCustomizer)` Configures authentication support using an SAML 2.0 Service Provider.
`SecurityContextConfigurer<HttpSecurity>`	`securityContext()` Sets up management of the `SecurityContext` on the `SecurityContextHolder` between `HttpServletRequest`'s.
`HttpSecurity`	`securityContext(Customizer<SecurityContextConfigurer<HttpSecurity>> securityContextCustomizer)` Sets up management of the `SecurityContext` on the `SecurityContextHolder` between `HttpServletRequest`'s.
`ServletApiConfigurer<HttpSecurity>`	`servletApi()` Integrates the `HttpServletRequest` methods with the values found on the `SecurityContext`.
`HttpSecurity`	`servletApi(Customizer<ServletApiConfigurer<HttpSecurity>> servletApiCustomizer)` Integrates the `HttpServletRequest` methods with the values found on the `SecurityContext`.
`SessionManagementConfigurer<HttpSecurity>`	`sessionManagement()` Allows configuring of Session Management.
`HttpSecurity`	`sessionManagement(Customizer<SessionManagementConfigurer<HttpSecurity>> sessionManagementCustomizer)` Allows configuring of Session Management.
`<C> void`	`setSharedObject(java.lang.Class<C> sharedType, C object)` Sets an object that is shared by multiple `SecurityConfigurer`.
`HttpSecurity`	`userDetailsService(UserDetailsService userDetailsService)` Allows adding an additional `UserDetailsService` to be used
`X509Configurer<HttpSecurity>`	`x509()` Configures X509 based pre authentication.
`HttpSecurity`	`x509(Customizer<X509Configurer<HttpSecurity>> x509Customizer)` Configures X509 based pre authentication.

Methods inherited from class org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder
apply, apply, beforeInit, doBuild, getConfigurer, getConfigurers, getOrBuild, getSharedObject, getSharedObjects, objectPostProcessor, postProcess, removeConfigurer, removeConfigurers

Methods inherited from class org.springframework.security.config.annotation.AbstractSecurityBuilder
build, getObject

Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.springframework.security.config.annotation.web.HttpSecurityBuilder
getConfigurer, getSharedObject, removeConfigurer

Methods inherited from interface org.springframework.security.config.annotation.SecurityBuilder
build

Constructor Detail
- HttpSecurity
```
public HttpSecurity(ObjectPostProcessor<java.lang.Object> objectPostProcessor,
                    AuthenticationManagerBuilder authenticationBuilder,
                    java.util.Map<java.lang.Class<?>,java.lang.Object> sharedObjects)
```
  Creates a new instance
  
  Parameters:
  
  objectPostProcessor - the ObjectPostProcessor that should be used
  
  authenticationBuilder - the AuthenticationManagerBuilder to use for additional updates
  
  sharedObjects - the shared Objects to initialize the HttpSecurity with
  
  See Also:
  
  WebSecurityConfiguration

Method Detail

openidLogin

public OpenIDLoginConfigurer<HttpSecurity> openidLogin()
                                                throws java.lang.Exception

Allows configuring OpenID based authentication.

Example Configurations

A basic example accepting the defaults and not using attribute exchange:

 @Configuration
 @EnableWebSecurity
 public class OpenIDLoginConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) {
                http.authorizeRequests().antMatchers("/**").hasRole("USER").and().openidLogin()
                                .permitAll();
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.inMemoryAuthentication()
                                // the username must match the OpenID of the user you are
                                // logging in with
                                .withUser(
                                                "https://www.google.com/accounts/o8/id?id=lmkCn9xzPdsxVwG7pjYMuDgNNdASFmobNkcRPaWU")
                                .password("password").roles("USER");
        }
 }

A more advanced example demonstrating using attribute exchange and providing a custom AuthenticationUserDetailsService that will make any user that authenticates a valid user.

 @Configuration
 @EnableWebSecurity
 public class OpenIDLoginConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) {
                http.authorizeRequests()
                                .antMatchers("/**")
                                .hasRole("USER")
                                .and()
                                .openidLogin()
                                .loginPage("/login")
                                .permitAll()
                                .authenticationUserDetailsService(
                                                new AutoProvisioningUserDetailsService())
                                .attributeExchange("https://www.google.com/.*").attribute("email")
                                .type("https://axschema.org/contact/email").required(true).and()
                                .attribute("firstname").type("https://axschema.org/namePerson/first")
                                .required(true).and().attribute("lastname")
                                .type("https://axschema.org/namePerson/last").required(true).and().and()
                                .attributeExchange(".*yahoo.com.*").attribute("email")
                                .type("https://schema.openid.net/contact/email").required(true).and()
                                .attribute("fullname").type("https://axschema.org/namePerson")
                                .required(true).and().and().attributeExchange(".*myopenid.com.*")
                                .attribute("email").type("https://schema.openid.net/contact/email")
                                .required(true).and().attribute("fullname")
                                .type("https://schema.openid.net/namePerson").required(true);
        }
 }

 public class AutoProvisioningUserDetailsService implements
                AuthenticationUserDetailsService<OpenIDAuthenticationToken> {
        public UserDetails loadUserDetails(OpenIDAuthenticationToken token)
                        throws UsernameNotFoundException {
                return new User(token.getName(), "NOTUSED",
                                AuthorityUtils.createAuthorityList("ROLE_USER"));
        }
 }

Returns:: the OpenIDLoginConfigurer for further customizations.
Throws:: java.lang.Exception
See Also:: OpenIDLoginConfigurer

openidLogin

public HttpSecurity openidLogin(Customizer<OpenIDLoginConfigurer<HttpSecurity>> openidLoginCustomizer)
                         throws java.lang.Exception

Allows configuring OpenID based authentication.

Example Configurations

A basic example accepting the defaults and not using attribute exchange:

 @Configuration
 @EnableWebSecurity
 public class OpenIDLoginConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .openidLogin(openidLogin ->
                                openidLogin
                                        .permitAll()
                        );
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.inMemoryAuthentication()
                                // the username must match the OpenID of the user you are
                                // logging in with
                                .withUser(
                                                "https://www.google.com/accounts/o8/id?id=lmkCn9xzPdsxVwG7pjYMuDgNNdASFmobNkcRPaWU")
                                .password("password").roles("USER");
        }
 }

A more advanced example demonstrating using attribute exchange and providing a custom AuthenticationUserDetailsService that will make any user that authenticates a valid user.

 @Configuration
 @EnableWebSecurity
 public class OpenIDLoginConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http.authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .openidLogin(openidLogin ->
                                openidLogin
                                        .loginPage("/login")
                                        .permitAll()
                                        .authenticationUserDetailsService(
                                                new AutoProvisioningUserDetailsService())
                                        .attributeExchange(googleExchange ->
                                                googleExchange
                                                        .identifierPattern("https://www.google.com/.*")
                                                        .attribute(emailAttribute ->
                                                                emailAttribute
                                                                        .name("email")
                                                                        .type("https://axschema.org/contact/email")
                                                                        .required(true)
                                                        )
                                                        .attribute(firstnameAttribute ->
                                                                firstnameAttribute
                                                                        .name("firstname")
                                                                        .type("https://axschema.org/namePerson/first")
                                                                        .required(true)
                                                        )
                                                        .attribute(lastnameAttribute ->
                                                                lastnameAttribute
                                                                        .name("lastname")
                                                                        .type("https://axschema.org/namePerson/last")
                                                                        .required(true)
                                                        )
                                        )
                                        .attributeExchange(yahooExchange ->
                                                yahooExchange
                                                        .identifierPattern(".*yahoo.com.*")
                                                        .attribute(emailAttribute ->
                                                                emailAttribute
                                                                        .name("email")
                                                                        .type("https://schema.openid.net/contact/email")
                                                                        .required(true)
                                                        )
                                                        .attribute(fullnameAttribute ->
                                                                fullnameAttribute
                                                                        .name("fullname")
                                                                        .type("https://axschema.org/namePerson")
                                                                        .required(true)
                                                        )
                                        )
                        );
        }
 }

 public class AutoProvisioningUserDetailsService implements
                AuthenticationUserDetailsService<OpenIDAuthenticationToken> {
        public UserDetails loadUserDetails(OpenIDAuthenticationToken token)
                        throws UsernameNotFoundException {
                return new User(token.getName(), "NOTUSED",
                                AuthorityUtils.createAuthorityList("ROLE_USER"));
        }
 }

Parameters:: openidLoginCustomizer - the Customizer to provide more options for the OpenIDLoginConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception
See Also:: OpenIDLoginConfigurer

headers

public HeadersConfigurer<HttpSecurity> headers()
                                        throws java.lang.Exception

Adds the Security headers to the response. This is activated by default when using WebSecurityConfigurerAdapter's default constructor. Accepting the default provided by WebSecurityConfigurerAdapter or only invoking headers() without invoking additional methods on it, is the equivalent of:

 @Configuration
 @EnableWebSecurity
 public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
     protected void configure(HttpSecurity http) throws Exception {
         http
             .headers()
                 .contentTypeOptions()
                 .and()
                 .xssProtection()
                 .and()
                 .cacheControl()
                 .and()
                 .httpStrictTransportSecurity()
                 .and()
                 .frameOptions()
                 .and()
             ...;
     }
 }

You can disable the headers using the following:

 @Configuration
 @EnableWebSecurity
 public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
     protected void configure(HttpSecurity http) throws Exception {
         http
             .headers().disable()
             ...;
     }
 }

You can enable only a few of the headers by first invoking HeadersConfigurer.defaultsDisabled() and then invoking the appropriate methods on the headers() result. For example, the following will enable HeadersConfigurer.cacheControl() and HeadersConfigurer.frameOptions() only.

 @Configuration
 @EnableWebSecurity
 public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
     protected void configure(HttpSecurity http) throws Exception {
         http
             .headers()
                  .defaultsDisabled()
                  .cacheControl()
                  .and()
                  .frameOptions()
                  .and()
             ...;
     }
 }

You can also choose to keep the defaults but explicitly disable a subset of headers. For example, the following will enable all the default headers except HeadersConfigurer.frameOptions().

 @Configuration
 @EnableWebSecurity
 public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
     protected void configure(HttpSecurity http) throws Exception {
         http
             .headers()
                  .frameOptions()
                        .disable()
                  .and()
             ...;
     }
 }

Returns:: the HeadersConfigurer for further customizations
Throws:: java.lang.Exception
See Also:: HeadersConfigurer

headers

public HttpSecurity headers(Customizer<HeadersConfigurer<HttpSecurity>> headersCustomizer)
                     throws java.lang.Exception

Adds the Security headers to the response. This is activated by default when using WebSecurityConfigurerAdapter's default constructor.

Example Configurations

Accepting the default provided by WebSecurityConfigurerAdapter or only invoking headers() without invoking additional methods on it, is the equivalent of:

 @Configuration
 @EnableWebSecurity
 public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .headers(headers ->
                                headers
                                        .contentTypeOptions(withDefaults())
                                        .xssProtection(withDefaults())
                                        .cacheControl(withDefaults())
                                        .httpStrictTransportSecurity(withDefaults())
                                        .frameOptions(withDefaults()
                        );
        }
 }

You can disable the headers using the following:

 @Configuration
 @EnableWebSecurity
 public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .headers(headers -> headers.disable());
        }
 }

 @Configuration
 @EnableWebSecurity
 public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .headers(headers ->
                                headers
                                        .defaultsDisabled()
                                        .cacheControl(withDefaults())
                                        .frameOptions(withDefaults())
                        );
        }
 }

You can also choose to keep the defaults but explicitly disable a subset of headers. For example, the following will enable all the default headers except HeadersConfigurer.frameOptions().

 @Configuration
 @EnableWebSecurity
 public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
  protected void configure(HttpSecurity http) throws Exception {
        http
                .headers(headers ->
                        headers
                                .frameOptions(frameOptions -> frameOptions.disable())
                );
 }

Parameters:: headersCustomizer - the Customizer to provide more options for the HeadersConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception

cors
```
public CorsConfigurer<HttpSecurity> cors()
                                  throws java.lang.Exception
```
Adds a CorsFilter to be used. If a bean by the name of corsFilter is provided, that CorsFilter is used. Else if corsConfigurationSource is defined, then that CorsConfiguration is used. Otherwise, if Spring MVC is on the classpath a HandlerMappingIntrospector is used.

Returns:

the CorsConfigurer for customizations

Throws:

java.lang.Exception

cors
```
public HttpSecurity cors(Customizer<CorsConfigurer<HttpSecurity>> corsCustomizer)
                  throws java.lang.Exception
```
Adds a CorsFilter to be used. If a bean by the name of corsFilter is provided, that CorsFilter is used. Else if corsConfigurationSource is defined, then that CorsConfiguration is used. Otherwise, if Spring MVC is on the classpath a HandlerMappingIntrospector is used. You can enable CORS using:
```
 @Configuration
 @EnableWebSecurity
 public class CorsSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
     protected void configure(HttpSecurity http) throws Exception {
         http
             .cors(withDefaults());
     }
 }
 
```
Parameters:

corsCustomizer - the Customizer to provide more options for the CorsConfigurer

Returns:

the HttpSecurity for further customizations

Throws:

java.lang.Exception

sessionManagement

public SessionManagementConfigurer<HttpSecurity> sessionManagement()
                                                            throws java.lang.Exception

Allows configuring of Session Management.

Example Configuration

The following configuration demonstrates how to enforce that only a single instance of a user is authenticated at a time. If a user authenticates with the username "user" without logging out and an attempt to authenticate with "user" is made the first session will be forcibly terminated and sent to the "/login?expired" URL.

 @Configuration
 @EnableWebSecurity
 public class SessionManagementSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http.authorizeRequests().anyRequest().hasRole("USER").and().formLogin()
                                .permitAll().and().sessionManagement().maximumSessions(1)
                                .expiredUrl("/login?expired");
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
        }
 }

When using SessionManagementConfigurer.maximumSessions(int), do not forget to configure HttpSessionEventPublisher for the application to ensure that expired sessions are cleaned up. In a web.xml this can be configured using the following:

 <listener>
      <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
 </listener>

Alternatively, AbstractSecurityWebApplicationInitializer.enableHttpSessionEventPublisher() could return true.

Returns:: the SessionManagementConfigurer for further customizations
Throws:: java.lang.Exception

sessionManagement

public HttpSecurity sessionManagement(Customizer<SessionManagementConfigurer<HttpSecurity>> sessionManagementCustomizer)
                               throws java.lang.Exception

Allows configuring of Session Management.

Example Configuration

 @Configuration
 @EnableWebSecurity
 public class SessionManagementSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .anyRequest().hasRole("USER")
                        )
                        .formLogin(formLogin ->
                                formLogin
                                        .permitAll()
                        )
                        .sessionManagement(sessionManagement ->
                                sessionManagement
                                        .sessionConcurrency(sessionConcurrency ->
                                                sessionConcurrency
                                                        .maximumSessions(1)
                                                        .expiredUrl("/login?expired")
                                        )
                        );
        }
 }

 <listener>
      <listener-class>org.springframework.security.web.session.HttpSessionEventPublisher</listener-class>
 </listener>

Alternatively, AbstractSecurityWebApplicationInitializer.enableHttpSessionEventPublisher() could return true.

Parameters:: sessionManagementCustomizer - the Customizer to provide more options for the SessionManagementConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception

portMapper

public PortMapperConfigurer<HttpSecurity> portMapper()
                                              throws java.lang.Exception

Allows configuring a PortMapper that is available from AbstractConfiguredSecurityBuilder.getSharedObject(Class). Other provided SecurityConfigurer objects use this configured PortMapper as a default PortMapper when redirecting from HTTP to HTTPS or from HTTPS to HTTP (for example when used in combination with requiresChannel(). By default Spring Security uses a PortMapperImpl which maps the HTTP port 8080 to the HTTPS port 8443 and the HTTP port of 80 to the HTTPS port of 443.

Example Configuration

The following configuration will ensure that redirects within Spring Security from HTTP of a port of 9090 will redirect to HTTPS port of 9443 and the HTTP port of 80 to the HTTPS port of 443.

 @Configuration
 @EnableWebSecurity
 public class PortMapperSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin()
                                .permitAll().and()
                                // Example portMapper() configuration
                                .portMapper().http(9090).mapsTo(9443).http(80).mapsTo(443);
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
        }
 }

Returns:: the PortMapperConfigurer for further customizations
Throws:: java.lang.Exception
See Also:: requiresChannel()

portMapper
```
public HttpSecurity portMapper(Customizer<PortMapperConfigurer<HttpSecurity>> portMapperCustomizer)
                        throws java.lang.Exception
```
Allows configuring a PortMapper that is available from AbstractConfiguredSecurityBuilder.getSharedObject(Class). Other provided SecurityConfigurer objects use this configured PortMapper as a default PortMapper when redirecting from HTTP to HTTPS or from HTTPS to HTTP (for example when used in combination with requiresChannel(). By default Spring Security uses a PortMapperImpl which maps the HTTP port 8080 to the HTTPS port 8443 and the HTTP port of 80 to the HTTPS port of 443.
Example Configuration
The following configuration will ensure that redirects within Spring Security from HTTP of a port of 9090 will redirect to HTTPS port of 9443 and the HTTP port of 80 to the HTTPS port of 443.
```
 @Configuration
 @EnableWebSecurity
 public class PortMapperSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .requiresChannel(requiresChannel ->
                                requiresChannel
                                        .anyRequest().requiresSecure()
                        )
                        .portMapper(portMapper ->
                                portMapper
                                        .http(9090).mapsTo(9443)
                                        .http(80).mapsTo(443)
                        );
        }
 }
 
```
Parameters:

portMapperCustomizer - the Customizer to provide more options for the PortMapperConfigurer

Returns:

the HttpSecurity for further customizations

Throws:

java.lang.Exception

See Also:

requiresChannel()

jee

public JeeConfigurer<HttpSecurity> jee()
                                throws java.lang.Exception

Configures container based pre authentication. In this case, authentication is managed by the Servlet Container.

Example Configuration

The following configuration will use the principal found on the HttpServletRequest and if the user is in the role "ROLE_USER" or "ROLE_ADMIN" will add that to the resulting Authentication.

 @Configuration
 @EnableWebSecurity
 public class JeeSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http.authorizeRequests().antMatchers("/**").hasRole("USER").and()
                // Example jee() configuration
                                .jee().mappableRoles("USER", "ADMIN");
        }
 }

Developers wishing to use pre authentication with the container will need to ensure their web.xml configures the security constraints. For example, the web.xml (there is no equivalent Java based configuration supported by the Servlet specification) might look like:

 <login-config>
     <auth-method>FORM</auth-method>
     <form-login-config>
         <form-login-page>/login</form-login-page>
         <form-error-page>/login?error</form-error-page>
     </form-login-config>
 </login-config>

 <security-role>
     <role-name>ROLE_USER</role-name>
 </security-role>
 <security-constraint>
     <web-resource-collection>
     <web-resource-name>Public</web-resource-name>
         <description>Matches unconstrained pages</description>
         <url-pattern>/login</url-pattern>
         <url-pattern>/logout</url-pattern>
         <url-pattern>/resources/*</url-pattern>
     </web-resource-collection>
 </security-constraint>
 <security-constraint>
     <web-resource-collection>
         <web-resource-name>Secured Areas</web-resource-name>
         <url-pattern>/*</url-pattern>
     </web-resource-collection>
     <auth-constraint>
         <role-name>ROLE_USER</role-name>
     </auth-constraint>
 </security-constraint>

Last you will need to configure your container to contain the user with the correct roles. This configuration is specific to the Servlet Container, so consult your Servlet Container's documentation.

Returns:: the JeeConfigurer for further customizations
Throws:: java.lang.Exception

jee

public HttpSecurity jee(Customizer<JeeConfigurer<HttpSecurity>> jeeCustomizer)
                 throws java.lang.Exception

Configures container based pre authentication. In this case, authentication is managed by the Servlet Container.

Example Configuration

The following configuration will use the principal found on the HttpServletRequest and if the user is in the role "ROLE_USER" or "ROLE_ADMIN" will add that to the resulting Authentication.

 @Configuration
 @EnableWebSecurity
 public class JeeSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .jee(jee ->
                                jee
                                        .mappableRoles("USER", "ADMIN")
                        );
        }
 }

 <login-config>
     <auth-method>FORM</auth-method>
     <form-login-config>
         <form-login-page>/login</form-login-page>
         <form-error-page>/login?error</form-error-page>
     </form-login-config>
 </login-config>

 <security-role>
     <role-name>ROLE_USER</role-name>
 </security-role>
 <security-constraint>
     <web-resource-collection>
     <web-resource-name>Public</web-resource-name>
         <description>Matches unconstrained pages</description>
         <url-pattern>/login</url-pattern>
         <url-pattern>/logout</url-pattern>
         <url-pattern>/resources/*</url-pattern>
     </web-resource-collection>
 </security-constraint>
 <security-constraint>
     <web-resource-collection>
         <web-resource-name>Secured Areas</web-resource-name>
         <url-pattern>/*</url-pattern>
     </web-resource-collection>
     <auth-constraint>
         <role-name>ROLE_USER</role-name>
     </auth-constraint>
 </security-constraint>

Last you will need to configure your container to contain the user with the correct roles. This configuration is specific to the Servlet Container, so consult your Servlet Container's documentation.

Parameters:: jeeCustomizer - the Customizer to provide more options for the JeeConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception

x509

public X509Configurer<HttpSecurity> x509()
                                  throws java.lang.Exception

Configures X509 based pre authentication.

Example Configuration

The following configuration will attempt to extract the username from the X509 certificate. Remember that the Servlet Container will need to be configured to request client certificates in order for this to work.

 @Configuration
 @EnableWebSecurity
 public class X509SecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http.authorizeRequests().antMatchers("/**").hasRole("USER").and()
                // Example x509() configuration
                                .x509();
        }
 }

Returns:: the X509Configurer for further customizations
Throws:: java.lang.Exception

x509

public HttpSecurity x509(Customizer<X509Configurer<HttpSecurity>> x509Customizer)
                  throws java.lang.Exception

Configures X509 based pre authentication.

Example Configuration

 @Configuration
 @EnableWebSecurity
 public class X509SecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .x509(withDefaults());
        }
 }

Parameters:: x509Customizer - the Customizer to provide more options for the X509Configurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception

rememberMe

public RememberMeConfigurer<HttpSecurity> rememberMe()
                                              throws java.lang.Exception

Allows configuring of Remember Me authentication.

Example Configuration

The following configuration demonstrates how to allow token based remember me authentication. Upon authenticating if the HTTP parameter named "remember-me" exists, then the user will be remembered even after their HttpSession expires.

 @Configuration
 @EnableWebSecurity
 public class RememberMeSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
        }

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin()
                                .permitAll().and()
                                // Example Remember Me Configuration
                                .rememberMe();
        }
 }

Returns:: the RememberMeConfigurer for further customizations
Throws:: java.lang.Exception

rememberMe

public HttpSecurity rememberMe(Customizer<RememberMeConfigurer<HttpSecurity>> rememberMeCustomizer)
                        throws java.lang.Exception

Allows configuring of Remember Me authentication.

Example Configuration

 @Configuration
 @EnableWebSecurity
 public class RememberMeSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .formLogin(withDefaults())
                        .rememberMe(withDefaults());
        }
 }

Parameters:: rememberMeCustomizer - the Customizer to provide more options for the RememberMeConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception

authorizeRequests

public ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrlRegistry authorizeRequests()
                                                                                      throws java.lang.Exception

Allows restricting access based upon the HttpServletRequest using RequestMatcher implementations (i.e. via URL patterns).

Example Configurations

The most basic example is to configure all URLs to require the role "ROLE_USER". The configuration below requires authentication to every URL and will grant access to both the user "admin" and "user".

 @Configuration
 @EnableWebSecurity
 public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin();
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
                                .and().withUser("admin").password("password").roles("ADMIN", "USER");
        }
 }

We can also configure multiple URLs. The configuration below requires authentication to every URL and will grant access to URLs starting with /admin/ to only the "admin" user. All other URLs either user can access.

 @Configuration
 @EnableWebSecurity
 public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http.authorizeRequests().antMatchers("/admin/**").hasRole("ADMIN")
                                .antMatchers("/**").hasRole("USER").and().formLogin();
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.inMemoryAuthentication().withUser("user").password("password").roles("USER")
                                .and().withUser("admin").password("password").roles("ADMIN", "USER");
        }
 }

Note that the matchers are considered in order. Therefore, the following is invalid because the first matcher matches every request and will never get to the second mapping:

 http.authorizeRequests().antMatchers("/**").hasRole("USER").antMatchers("/admin/**")
                .hasRole("ADMIN")

Returns:: the ExpressionUrlAuthorizationConfigurer for further customizations
Throws:: java.lang.Exception
See Also:: requestMatcher(RequestMatcher)

authorizeRequests

public HttpSecurity authorizeRequests(Customizer<ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrlRegistry> authorizeRequestsCustomizer)
                               throws java.lang.Exception

Allows restricting access based upon the HttpServletRequest using RequestMatcher implementations (i.e. via URL patterns).

Example Configurations

 @Configuration
 @EnableWebSecurity
 public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .formLogin(withDefaults());
        }
 }

 @Configuration
 @EnableWebSecurity
 public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/admin/**").hasRole("ADMIN")
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .formLogin(withDefaults());
        }
 }

Note that the matchers are considered in order. Therefore, the following is invalid because the first matcher matches every request and will never get to the second mapping:

 @Configuration
 @EnableWebSecurity
 public class AuthorizeUrlsSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                 http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                                        .antMatchers("/admin/**").hasRole("ADMIN")
                        );
        }
 }

Parameters:: authorizeRequestsCustomizer - the Customizer to provide more options for the ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrlRegistry
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception
See Also:: requestMatcher(RequestMatcher)

requestCache
```
public RequestCacheConfigurer<HttpSecurity> requestCache()
                                                  throws java.lang.Exception
```
Allows configuring the Request Cache. For example, a protected page (/protected) may be requested prior to authentication. The application will redirect the user to a login page. After authentication, Spring Security will redirect the user to the originally requested protected page (/protected). This is automatically applied when using WebSecurityConfigurerAdapter.

Returns:

the RequestCacheConfigurer for further customizations

Throws:

java.lang.Exception

requestCache

public HttpSecurity requestCache(Customizer<RequestCacheConfigurer<HttpSecurity>> requestCacheCustomizer)
                          throws java.lang.Exception

Allows configuring the Request Cache. For example, a protected page (/protected) may be requested prior to authentication. The application will redirect the user to a login page. After authentication, Spring Security will redirect the user to the originally requested protected page (/protected). This is automatically applied when using WebSecurityConfigurerAdapter.

Example Custom Configuration

The following example demonstrates how to disable request caching.

 @Configuration
 @EnableWebSecurity
 public class RequestCacheDisabledSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .requestCache(requestCache ->
                                requestCache.disable()
                        );
        }
 }

Parameters:: requestCacheCustomizer - the Customizer to provide more options for the RequestCacheConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception

exceptionHandling
```
public ExceptionHandlingConfigurer<HttpSecurity> exceptionHandling()
                                                            throws java.lang.Exception
```
Allows configuring exception handling. This is automatically applied when using WebSecurityConfigurerAdapter.

Returns:

the ExceptionHandlingConfigurer for further customizations

Throws:

java.lang.Exception

exceptionHandling

public HttpSecurity exceptionHandling(Customizer<ExceptionHandlingConfigurer<HttpSecurity>> exceptionHandlingCustomizer)
                               throws java.lang.Exception

Allows configuring exception handling. This is automatically applied when using WebSecurityConfigurerAdapter.

Example Custom Configuration

The following customization will ensure that users who are denied access are forwarded to the page "/errors/access-denied".

 @Configuration
 @EnableWebSecurity
 public class ExceptionHandlingSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        // sample exception handling customization
                        .exceptionHandling(exceptionHandling ->
                                exceptionHandling
                                        .accessDeniedPage("/errors/access-denied")
                        );
        }
 }

Parameters:: exceptionHandlingCustomizer - the Customizer to provide more options for the ExceptionHandlingConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception

securityContext
```
public SecurityContextConfigurer<HttpSecurity> securityContext()
                                                        throws java.lang.Exception
```
Sets up management of the SecurityContext on the SecurityContextHolder between HttpServletRequest's. This is automatically applied when using WebSecurityConfigurerAdapter.

Returns:

the SecurityContextConfigurer for further customizations

Throws:

java.lang.Exception

securityContext

public HttpSecurity securityContext(Customizer<SecurityContextConfigurer<HttpSecurity>> securityContextCustomizer)
                             throws java.lang.Exception

Sets up management of the SecurityContext on the SecurityContextHolder between HttpServletRequest's. This is automatically applied when using WebSecurityConfigurerAdapter. The following customization specifies the shared SecurityContextRepository

 @Configuration
 @EnableWebSecurity
 public class SecurityContextSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .securityContext(securityContext ->
                                securityContext
                                        .securityContextRepository(SCR)
                        );
        }
 }

Parameters:: securityContextCustomizer - the Customizer to provide more options for the SecurityContextConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception

servletApi
```
public ServletApiConfigurer<HttpSecurity> servletApi()
                                              throws java.lang.Exception
```
Integrates the HttpServletRequest methods with the values found on the SecurityContext. This is automatically applied when using WebSecurityConfigurerAdapter.

Returns:

the ServletApiConfigurer for further customizations

Throws:

java.lang.Exception

servletApi

public HttpSecurity servletApi(Customizer<ServletApiConfigurer<HttpSecurity>> servletApiCustomizer)
                        throws java.lang.Exception

Integrates the HttpServletRequest methods with the values found on the SecurityContext. This is automatically applied when using WebSecurityConfigurerAdapter. You can disable it using:

 @Configuration
 @EnableWebSecurity
 public class ServletApiSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .servletApi(servletApi ->
                                servletApi.disable()
                        );
        }
 }

Parameters:: servletApiCustomizer - the Customizer to provide more options for the ServletApiConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception

csrf

public CsrfConfigurer<HttpSecurity> csrf()
                                  throws java.lang.Exception

Adds CSRF support. This is activated by default when using WebSecurityConfigurerAdapter's default constructor. You can disable it using:

 @Configuration
 @EnableWebSecurity
 public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
     protected void configure(HttpSecurity http) throws Exception {
         http
             .csrf().disable()
             ...;
     }
 }

Returns:: the CsrfConfigurer for further customizations
Throws:: java.lang.Exception

csrf

public HttpSecurity csrf(Customizer<CsrfConfigurer<HttpSecurity>> csrfCustomizer)
                  throws java.lang.Exception

Adds CSRF support. This is activated by default when using WebSecurityConfigurerAdapter's default constructor. You can disable it using:

 @Configuration
 @EnableWebSecurity
 public class CsrfSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
     protected void configure(HttpSecurity http) throws Exception {
         http
             .csrf(csrf -> csrf.disable());
     }
 }

Parameters:: csrfCustomizer - the Customizer to provide more options for the CsrfConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception

logout

public LogoutConfigurer<HttpSecurity> logout()
                                      throws java.lang.Exception

Provides logout support. This is automatically applied when using WebSecurityConfigurerAdapter. The default is that accessing the URL "/logout" will log the user out by invalidating the HTTP Session, cleaning up any rememberMe() authentication that was configured, clearing the SecurityContextHolder, and then redirect to "/login?success".

Example Custom Configuration

The following customization to log out when the URL "/custom-logout" is invoked. Log out will remove the cookie named "remove", not invalidate the HttpSession, clear the SecurityContextHolder, and upon completion redirect to "/logout-success".

 @Configuration
 @EnableWebSecurity
 public class LogoutSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin()
                                .and()
                                // sample logout customization
                                .logout().deleteCookies("remove").invalidateHttpSession(false)
                                .logoutUrl("/custom-logout").logoutSuccessUrl("/logout-success");
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
        }
 }

Returns:: the LogoutConfigurer for further customizations
Throws:: java.lang.Exception

logout

public HttpSecurity logout(Customizer<LogoutConfigurer<HttpSecurity>> logoutCustomizer)
                    throws java.lang.Exception

Example Custom Configuration

 @Configuration
 @EnableWebSecurity
 public class LogoutSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .formLogin(withDefaults())
                        // sample logout customization
                        .logout(logout ->
                                logout.deleteCookies("remove")
                                        .invalidateHttpSession(false)
                                        .logoutUrl("/custom-logout")
                                        .logoutSuccessUrl("/logout-success")
                        );
        }
 }

Parameters:: logoutCustomizer - the Customizer to provide more options for the LogoutConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception

anonymous

public AnonymousConfigurer<HttpSecurity> anonymous()
                                            throws java.lang.Exception

Allows configuring how an anonymous user is represented. This is automatically applied when used in conjunction with WebSecurityConfigurerAdapter. By default anonymous users will be represented with an AnonymousAuthenticationToken and contain the role "ROLE_ANONYMOUS".

Example Configuration

The following configuration demonstrates how to specify that anonymous users should contain the role "ROLE_ANON" instead.

 @Configuration
 @EnableWebSecurity
 public class AnonymousSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests()
                                .antMatchers("/**").hasRole("USER")
                                .and()
                        .formLogin()
                                .and()
                        // sample anonymous customization
                        .anonymous().authorities("ROLE_ANON");
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
        }
 }

The following demonstrates how to represent anonymous users as null. Note that this can cause NullPointerException in code that assumes anonymous authentication is enabled.

 @Configuration
 @EnableWebSecurity
 public class AnonymousSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests()
                                .antMatchers("/**").hasRole("USER")
                                .and()
                        .formLogin()
                                .and()
                        // sample anonymous customization
                        .anonymous().disable();
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
        }
 }

Returns:: the AnonymousConfigurer for further customizations
Throws:: java.lang.Exception

anonymous

public HttpSecurity anonymous(Customizer<AnonymousConfigurer<HttpSecurity>> anonymousCustomizer)
                       throws java.lang.Exception

Example Configuration

The following configuration demonstrates how to specify that anonymous users should contain the role "ROLE_ANON" instead.

 @Configuration
 @EnableWebSecurity
 public class AnonymousSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .formLogin(withDefaults())
                        // sample anonymous customization
                        .anonymous(anonymous ->
                                anonymous
                                        .authorities("ROLE_ANON")
                        )
        }
 }

The following demonstrates how to represent anonymous users as null. Note that this can cause NullPointerException in code that assumes anonymous authentication is enabled.

 @Configuration
 @EnableWebSecurity
 public class AnonymousSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .formLogin(withDefaults())
                        // sample anonymous customization
                        .anonymous(anonymous ->
                                anonymous.disable()
                        );
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
        }
 }

Parameters:: anonymousCustomizer - the Customizer to provide more options for the AnonymousConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception

formLogin

public FormLoginConfigurer<HttpSecurity> formLogin()
                                            throws java.lang.Exception

Specifies to support form based authentication. If FormLoginConfigurer.loginPage(String) is not specified a default login page will be generated.

Example Configurations

The most basic configuration defaults to automatically generating a login page at the URL "/login", redirecting to "/login?error" for authentication failure. The details of the login page can be found on FormLoginConfigurer.loginPage(String)

 @Configuration
 @EnableWebSecurity
 public class FormLoginSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin();
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
        }
 }

The configuration below demonstrates customizing the defaults.

 @Configuration
 @EnableWebSecurity
 public class FormLoginSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin()
                                .usernameParameter("username") // default is username
                                .passwordParameter("password") // default is password
                                .loginPage("/authentication/login") // default is /login with an HTTP get
                                .failureUrl("/authentication/login?failed") // default is /login?error
                                .loginProcessingUrl("/authentication/login/process"); // default is /login
                                                                                                                                                // with an HTTP
                                                                                                                                                // post
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
        }
 }

Returns:: the FormLoginConfigurer for further customizations
Throws:: java.lang.Exception
See Also:: FormLoginConfigurer.loginPage(String)

formLogin

public HttpSecurity formLogin(Customizer<FormLoginConfigurer<HttpSecurity>> formLoginCustomizer)
                       throws java.lang.Exception

Specifies to support form based authentication. If FormLoginConfigurer.loginPage(String) is not specified a default login page will be generated.

Example Configurations

 @Configuration
 @EnableWebSecurity
 public class FormLoginSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .formLogin(withDefaults());
        }
 }

The configuration below demonstrates customizing the defaults.

 @Configuration
 @EnableWebSecurity
 public class FormLoginSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .formLogin(formLogin ->
                                formLogin
                                        .usernameParameter("username")
                                        .passwordParameter("password")
                                        .loginPage("/authentication/login")
                                        .failureUrl("/authentication/login?failed")
                                        .loginProcessingUrl("/authentication/login/process")
                        );
        }
 }

Parameters:: formLoginCustomizer - the Customizer to provide more options for the FormLoginConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception
See Also:: FormLoginConfigurer.loginPage(String)

saml2Login

public Saml2LoginConfigurer<HttpSecurity> saml2Login()
                                              throws java.lang.Exception

Configures authentication support using an SAML 2.0 Service Provider.

The "authentication flow" is implemented using the Web Browser SSO Profile, using POST and REDIRECT bindings, as documented in the SAML V2.0 Core,Profiles and Bindings specifications.

As a prerequisite to using this feature, is that you have a SAML v2.0 Identity Provider to provide an assertion. The representation of the Service Provider, the relying party, and the remote Identity Provider, the asserting party is contained within RelyingPartyRegistration.

RelyingPartyRegistration(s) are composed within a RelyingPartyRegistrationRepository, which is required and must be registered with the ApplicationContext or configured via saml2Login().relyingPartyRegistrationRepository(..).

The default configuration provides an auto-generated login page at "/login" and redirects to "/login?error" when an authentication error occurs. The login page will display each of the identity providers with a link that is capable of initiating the "authentication flow".

Example Configuration

The following example shows the minimal configuration required, using SimpleSamlPhp as the Authentication Provider.

 @Configuration
 public class Saml2LoginConfig {

        @EnableWebSecurity
        public static class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
                @Override
                protected void configure(HttpSecurity http) throws Exception {
                        http
                                .authorizeRequests()
                                        .anyRequest().authenticated()
                                        .and()
                                  .saml2Login();
                }
        }

        @Bean
        public RelyingPartyRegistrationRepository relyingPartyRegistrationRepository() {
                return new InMemoryRelyingPartyRegistrationRepository(this.getSaml2RelyingPartyRegistration());
        }

        private RelyingPartyRegistration getSaml2RelyingPartyRegistration() {
                //remote IDP entity ID
                String idpEntityId = "https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php";
                //remote WebSSO Endpoint - Where to Send AuthNRequests to
                String webSsoEndpoint = "https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/SSOService.php";
                //local registration ID
                String registrationId = "simplesamlphp";
                //local entity ID - autogenerated based on URL
                String localEntityIdTemplate = "{baseUrl}/saml2/service-provider-metadata/{registrationId}";
                //local signing (and decryption key)
                Saml2X509Credential signingCredential = getSigningCredential();
                //IDP certificate for verification of incoming messages
                Saml2X509Credential idpVerificationCertificate = getVerificationCertificate();
                return RelyingPartyRegistration.withRegistrationId(registrationId)
  *                             .remoteIdpEntityId(idpEntityId)
  *                             .idpWebSsoUrl(webSsoEndpoint)
  *                             .credential(signingCredential)
  *                             .credential(idpVerificationCertificate)
  *                             .localEntityIdTemplate(localEntityIdTemplate)
  *                             .build();
        }
 }

Returns:: the Saml2LoginConfigurer for further customizations
Throws:: java.lang.Exception
Since:: 5.2

saml2Login

public HttpSecurity saml2Login(Customizer<Saml2LoginConfigurer<HttpSecurity>> saml2LoginCustomizer)
                        throws java.lang.Exception

Example Configuration

The following example shows the minimal configuration required, using SimpleSamlPhp as the Authentication Provider.

 @Configuration
 public class Saml2LoginConfig {

        @EnableWebSecurity
        public static class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
                @Override
                protected void configure(HttpSecurity http) throws Exception {
                        http
                                .authorizeRequests()
                                        .anyRequest().authenticated()
                                        .and()
                                  .saml2Login(withDefaults());
                }
        }

        @Bean
        public RelyingPartyRegistrationRepository relyingPartyRegistrationRepository() {
                return new InMemoryRelyingPartyRegistrationRepository(this.getSaml2RelyingPartyRegistration());
        }

        private RelyingPartyRegistration getSaml2RelyingPartyRegistration() {
                //remote IDP entity ID
                String idpEntityId = "https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/metadata.php";
                //remote WebSSO Endpoint - Where to Send AuthNRequests to
                String webSsoEndpoint = "https://simplesaml-for-spring-saml.cfapps.io/saml2/idp/SSOService.php";
                //local registration ID
                String registrationId = "simplesamlphp";
                //local entity ID - autogenerated based on URL
                String localEntityIdTemplate = "{baseUrl}/saml2/service-provider-metadata/{registrationId}";
                //local signing (and decryption key)
                Saml2X509Credential signingCredential = getSigningCredential();
                //IDP certificate for verification of incoming messages
                Saml2X509Credential idpVerificationCertificate = getVerificationCertificate();
                return RelyingPartyRegistration.withRegistrationId(registrationId)
  *                             .remoteIdpEntityId(idpEntityId)
  *                             .idpWebSsoUrl(webSsoEndpoint)
  *                             .credential(signingCredential)
  *                             .credential(idpVerificationCertificate)
  *                             .localEntityIdTemplate(localEntityIdTemplate)
  *                             .build();
        }
 }

Parameters:: saml2LoginCustomizer - the Customizer to provide more options for the Saml2LoginConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception
Since:: 5.2

oauth2Login

public OAuth2LoginConfigurer<HttpSecurity> oauth2Login()
                                                throws java.lang.Exception

Configures authentication support using an OAuth 2.0 and/or OpenID Connect 1.0 Provider.

The "authentication flow" is implemented using the Authorization Code Grant, as specified in the OAuth 2.0 Authorization Framework and OpenID Connect Core 1.0 specification.

As a prerequisite to using this feature, you must register a client with a provider. The client registration information may than be used for configuring a ClientRegistration using a ClientRegistration.Builder.

ClientRegistration(s) are composed within a ClientRegistrationRepository, which is required and must be registered with the ApplicationContext or configured via oauth2Login().clientRegistrationRepository(..).

The default configuration provides an auto-generated login page at "/login" and redirects to "/login?error" when an authentication error occurs. The login page will display each of the clients with a link that is capable of initiating the "authentication flow".

Example Configuration

The following example shows the minimal configuration required, using Google as the Authentication Provider.

 @Configuration
 public class OAuth2LoginConfig {

        @EnableWebSecurity
        public static class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
                @Override
                protected void configure(HttpSecurity http) throws Exception {
                        http
                                .authorizeRequests()
                                        .anyRequest().authenticated()
                                        .and()
                                  .oauth2Login();
                }
        }

        @Bean
        public ClientRegistrationRepository clientRegistrationRepository() {
                return new InMemoryClientRegistrationRepository(this.googleClientRegistration());
        }

        private ClientRegistration googleClientRegistration() {
                return ClientRegistration.withRegistrationId("google")
                        .clientId("google-client-id")
                        .clientSecret("google-client-secret")
                        .clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
                        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
                        .redirectUriTemplate("{baseUrl}/login/oauth2/code/{registrationId}")
                        .scope("openid", "profile", "email", "address", "phone")
                        .authorizationUri("https://accounts.google.com/o/oauth2/v2/auth")
                        .tokenUri("https://www.googleapis.com/oauth2/v4/token")
                        .userInfoUri("https://www.googleapis.com/oauth2/v3/userinfo")
                        .userNameAttributeName(IdTokenClaimNames.SUB)
                        .jwkSetUri("https://www.googleapis.com/oauth2/v3/certs")
                        .clientName("Google")
                        .build();
        }
 }

For more advanced configuration, see OAuth2LoginConfigurer for available options to customize the defaults.

Returns:: the OAuth2LoginConfigurer for further customizations
Throws:: java.lang.Exception
Since:: 5.0
See Also:: Section 4.1 Authorization Code Grant, Section 3.1 Authorization Code Flow, ClientRegistration, ClientRegistrationRepository

oauth2Login

public HttpSecurity oauth2Login(Customizer<OAuth2LoginConfigurer<HttpSecurity>> oauth2LoginCustomizer)
                         throws java.lang.Exception

Example Configuration

The following example shows the minimal configuration required, using Google as the Authentication Provider.

 @Configuration
 public class OAuth2LoginConfig {

        @EnableWebSecurity
        public static class OAuth2LoginSecurityConfig extends WebSecurityConfigurerAdapter {
                @Override
                protected void configure(HttpSecurity http) throws Exception {
                        http
                                .authorizeRequests(authorizeRequests ->
                                        authorizeRequests
                                                .anyRequest().authenticated()
                                )
                                .oauth2Login(withDefaults());
                }
        }

        @Bean
        public ClientRegistrationRepository clientRegistrationRepository() {
                return new InMemoryClientRegistrationRepository(this.googleClientRegistration());
        }

        private ClientRegistration googleClientRegistration() {
                return ClientRegistration.withRegistrationId("google")
                        .clientId("google-client-id")
                        .clientSecret("google-client-secret")
                        .clientAuthenticationMethod(ClientAuthenticationMethod.BASIC)
                        .authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
                        .redirectUriTemplate("{baseUrl}/login/oauth2/code/{registrationId}")
                        .scope("openid", "profile", "email", "address", "phone")
                        .authorizationUri("https://accounts.google.com/o/oauth2/v2/auth")
                        .tokenUri("https://www.googleapis.com/oauth2/v4/token")
                        .userInfoUri("https://www.googleapis.com/oauth2/v3/userinfo")
                        .userNameAttributeName(IdTokenClaimNames.SUB)
                        .jwkSetUri("https://www.googleapis.com/oauth2/v3/certs")
                        .clientName("Google")
                        .build();
        }
 }

For more advanced configuration, see OAuth2LoginConfigurer for available options to customize the defaults.

Parameters:: oauth2LoginCustomizer - the Customizer to provide more options for the OAuth2LoginConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception
See Also:: Section 4.1 Authorization Code Grant, Section 3.1 Authorization Code Flow, ClientRegistration, ClientRegistrationRepository

oauth2Client
```
public OAuth2ClientConfigurer<HttpSecurity> oauth2Client()
                                                  throws java.lang.Exception
```
Configures OAuth 2.0 Client support.

Returns:

the OAuth2ClientConfigurer for further customizations

Throws:

java.lang.Exception

Since:

5.1

See Also:

OAuth 2.0 Authorization Framework

oauth2Client

public HttpSecurity oauth2Client(Customizer<OAuth2ClientConfigurer<HttpSecurity>> oauth2ClientCustomizer)
                          throws java.lang.Exception

Configures OAuth 2.0 Client support.

Example Configuration

The following example demonstrates how to enable OAuth 2.0 Client support for all endpoints.

 @Configuration
 @EnableWebSecurity
 public class OAuth2ClientSecurityConfig extends WebSecurityConfigurerAdapter {
        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .anyRequest().authenticated()
                        )
                        .oauth2Client(withDefaults());
        }
 }

Parameters:: oauth2ClientCustomizer - the Customizer to provide more options for the OAuth2ClientConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception
See Also:: OAuth 2.0 Authorization Framework

oauth2ResourceServer
```
public OAuth2ResourceServerConfigurer<HttpSecurity> oauth2ResourceServer()
                                                                  throws java.lang.Exception
```
Configures OAuth 2.0 Resource Server support.

Returns:

the OAuth2ResourceServerConfigurer for further customizations

Throws:

java.lang.Exception

Since:

5.1

See Also:

OAuth 2.0 Authorization Framework

oauth2ResourceServer

public HttpSecurity oauth2ResourceServer(Customizer<OAuth2ResourceServerConfigurer<HttpSecurity>> oauth2ResourceServerCustomizer)
                                  throws java.lang.Exception

Configures OAuth 2.0 Resource Server support.

Example Configuration

The following example demonstrates how to configure a custom JWT authentication converter.

 @Configuration
 @EnableWebSecurity
 public class OAuth2ClientSecurityConfig extends WebSecurityConfigurerAdapter {

 @Value("${spring.security.oauth2.resourceserver.jwt.key-value}")
 RSAPublicKey key;

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .anyRequest().authenticated()
                        )
                        .oauth2ResourceServer(oauth2ResourceServer ->
                                oauth2ResourceServer
                                        .jwt(jwt ->
                                                jwt
                                                        .decoder(jwtDecoder())
                                        )
                        );
        }

        @Bean
        public JwtDecoder jwtDecoder() {
                return NimbusJwtDecoder.withPublicKey(this.key).build();
        }
 }

Parameters:: oauth2ResourceServerCustomizer - the Customizer to provide more options for the OAuth2ResourceServerConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception
See Also:: OAuth 2.0 Authorization Framework

requiresChannel

public ChannelSecurityConfigurer.ChannelRequestMatcherRegistry requiresChannel()
                                                                        throws java.lang.Exception

Configures channel security. In order for this configuration to be useful at least one mapping to a required channel must be provided.

Example Configuration

The example below demonstrates how to require HTTPs for every request. Only requiring HTTPS for some requests is supported, but not recommended since an application that allows for HTTP introduces many security vulnerabilities. For one such example, read about Firesheep.

 @Configuration
 @EnableWebSecurity
 public class ChannelSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http.authorizeRequests().antMatchers("/**").hasRole("USER").and().formLogin()
                                .and().requiresChannel().anyRequest().requiresSecure();
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
        }
 }

Returns:: the ChannelSecurityConfigurer for further customizations
Throws:: java.lang.Exception

requiresChannel

public HttpSecurity requiresChannel(Customizer<ChannelSecurityConfigurer.ChannelRequestMatcherRegistry> requiresChannelCustomizer)
                             throws java.lang.Exception

Configures channel security. In order for this configuration to be useful at least one mapping to a required channel must be provided.

Example Configuration

 @Configuration
 @EnableWebSecurity
 public class ChannelSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .formLogin(withDefaults())
                        .requiresChannel(requiresChannel ->
                                requiresChannel
                                        .anyRequest().requiresSecure()
                        );
        }
 }

Parameters:: requiresChannelCustomizer - the Customizer to provide more options for the ChannelSecurityConfigurer.ChannelRequestMatcherRegistry
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception

httpBasic

public HttpBasicConfigurer<HttpSecurity> httpBasic()
                                            throws java.lang.Exception

Configures HTTP Basic authentication.

Example Configuration

The example below demonstrates how to configure HTTP Basic authentication for an application. The default realm is "Realm", but can be customized using HttpBasicConfigurer.realmName(String).

 @Configuration
 @EnableWebSecurity
 public class HttpBasicSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http.authorizeRequests().antMatchers("/**").hasRole("USER").and().httpBasic();
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth.inMemoryAuthentication().withUser("user").password("password").roles("USER");
        }
 }

Returns:: the HttpBasicConfigurer for further customizations
Throws:: java.lang.Exception

httpBasic

public HttpSecurity httpBasic(Customizer<HttpBasicConfigurer<HttpSecurity>> httpBasicCustomizer)
                       throws java.lang.Exception

Configures HTTP Basic authentication.

Example Configuration

The example below demonstrates how to configure HTTP Basic authentication for an application. The default realm is "Realm", but can be customized using HttpBasicConfigurer.realmName(String).

 @Configuration
 @EnableWebSecurity
 public class HttpBasicSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .httpBasic(withDefaults());
        }
 }

Parameters:: httpBasicCustomizer - the Customizer to provide more options for the HttpBasicConfigurer
Returns:: the HttpSecurity for further customizations
Throws:: java.lang.Exception

setSharedObject
```
public <C> void setSharedObject(java.lang.Class<C> sharedType,
                                C object)
```
Description copied from class: AbstractConfiguredSecurityBuilder

Sets an object that is shared by multiple SecurityConfigurer.

Specified by:

setSharedObject in interface HttpSecurityBuilder<HttpSecurity>

Overrides:

setSharedObject in class AbstractConfiguredSecurityBuilder<DefaultSecurityFilterChain,HttpSecurity>

Parameters:

sharedType - the Class to key the shared object by.

object - the Object to store

beforeConfigure
```
protected void beforeConfigure()
                        throws java.lang.Exception
```
Description copied from class: AbstractConfiguredSecurityBuilder

Invoked prior to invoking each SecurityConfigurer.configure(SecurityBuilder) method. Subclasses may override this method to hook into the lifecycle without using a SecurityConfigurer.

Overrides:

beforeConfigure in class AbstractConfiguredSecurityBuilder<DefaultSecurityFilterChain,HttpSecurity>

Throws:

java.lang.Exception

performBuild
```
protected DefaultSecurityFilterChain performBuild()
```
Description copied from class: AbstractConfiguredSecurityBuilder

Subclasses must implement this method to build the object that is being returned.

Specified by:

performBuild in class AbstractConfiguredSecurityBuilder<DefaultSecurityFilterChain,HttpSecurity>

Returns:

the Object to be buit or null if the implementation allows it

authenticationProvider
```
public HttpSecurity authenticationProvider(AuthenticationProvider authenticationProvider)
```
Description copied from interface: HttpSecurityBuilder

Allows adding an additional AuthenticationProvider to be used

Specified by:

authenticationProvider in interface HttpSecurityBuilder<HttpSecurity>

Parameters:

authenticationProvider - the AuthenticationProvider to be added

Returns:

the HttpSecurity for further customizations

userDetailsService
```
public HttpSecurity userDetailsService(UserDetailsService userDetailsService)
                                throws java.lang.Exception
```
Description copied from interface: HttpSecurityBuilder

Allows adding an additional UserDetailsService to be used

Specified by:

userDetailsService in interface HttpSecurityBuilder<HttpSecurity>

Parameters:

userDetailsService - the UserDetailsService to be added

Returns:

the HttpSecurity for further customizations

Throws:

java.lang.Exception

addFilterAfter
```
public HttpSecurity addFilterAfter(javax.servlet.Filter filter,
                                   java.lang.Class<? extends javax.servlet.Filter> afterFilter)
```
Description copied from interface: HttpSecurityBuilder

Allows adding a Filter after one of the known Filter classes. The known Filter instances are either a Filter listed in HttpSecurityBuilder.addFilter(Filter) or a Filter that has already been added using HttpSecurityBuilder.addFilterAfter(Filter, Class) or HttpSecurityBuilder.addFilterBefore(Filter, Class).

Specified by:

addFilterAfter in interface HttpSecurityBuilder<HttpSecurity>

Parameters:

filter - the Filter to register after the type afterFilter

afterFilter - the Class of the known Filter.

Returns:

the HttpSecurity for further customizations

addFilterBefore
```
public HttpSecurity addFilterBefore(javax.servlet.Filter filter,
                                    java.lang.Class<? extends javax.servlet.Filter> beforeFilter)
```
Description copied from interface: HttpSecurityBuilder

Allows adding a Filter before one of the known Filter classes. The known Filter instances are either a Filter listed in HttpSecurityBuilder.addFilter(Filter) or a Filter that has already been added using HttpSecurityBuilder.addFilterAfter(Filter, Class) or HttpSecurityBuilder.addFilterBefore(Filter, Class).

Specified by:

addFilterBefore in interface HttpSecurityBuilder<HttpSecurity>

Parameters:

filter - the Filter to register before the type beforeFilter

beforeFilter - the Class of the known Filter.

Returns:

the HttpSecurity for further customizations

addFilter
```
public HttpSecurity addFilter(javax.servlet.Filter filter)
```
Description copied from interface: HttpSecurityBuilder
Adds a Filter that must be an instance of or extend one of the Filters provided within the Security framework. The method ensures that the ordering of the Filters is automatically taken care of. The ordering of the Filters is:
Specified by:

addFilter in interface HttpSecurityBuilder<HttpSecurity>

Parameters:

filter - the Filter to add

Returns:

the HttpSecurity for further customizations

addFilterAt
```
public HttpSecurity addFilterAt(javax.servlet.Filter filter,
                                java.lang.Class<? extends javax.servlet.Filter> atFilter)
```
Adds the Filter at the location of the specified Filter class. For example, if you want the filter CustomFilter to be registered in the same position as UsernamePasswordAuthenticationFilter, you can invoke:
```
 addFilterAt(new CustomFilter(), UsernamePasswordAuthenticationFilter.class)
 
```
Registration of multiple Filters in the same location means their ordering is not deterministic. More concretely, registering multiple Filters in the same location does not override existing Filters. Instead, do not register Filters you do not want to use.
Parameters:

filter - the Filter to register

atFilter - the location of another Filter that is already registered (i.e. known) with Spring Security.

Returns:

the HttpSecurity for further customizations

requestMatchers

public HttpSecurity.RequestMatcherConfigurer requestMatchers()

Allows specifying which HttpServletRequest instances this HttpSecurity will be invoked on. This method allows for easily invoking the HttpSecurity for multiple different RequestMatcher instances. If only a single RequestMatcher is necessary consider using mvcMatcher(String), antMatcher(String), regexMatcher(String), or requestMatcher(RequestMatcher).

Invoking requestMatchers() will not override previous invocations of mvcMatcher(String)}, requestMatchers(), antMatcher(String), regexMatcher(String), and requestMatcher(RequestMatcher).

Example Configurations

The following configuration enables the HttpSecurity for URLs that begin with "/api/" or "/oauth/".

 @Configuration
 @EnableWebSecurity
 public class RequestMatchersSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .requestMatchers()
                                .antMatchers("/api/**", "/oauth/**")
                                .and()
                        .authorizeRequests()
                                .antMatchers("/**").hasRole("USER")
                                .and()
                        .httpBasic();
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth
                        .inMemoryAuthentication()
                                .withUser("user").password("password").roles("USER");
        }
 }

The configuration below is the same as the previous configuration.

 @Configuration
 @EnableWebSecurity
 public class RequestMatchersSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .requestMatchers()
                                .antMatchers("/api/**")
                                .antMatchers("/oauth/**")
                                .and()
                        .authorizeRequests()
                                .antMatchers("/**").hasRole("USER")
                                .and()
                        .httpBasic();
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth
                        .inMemoryAuthentication()
                                .withUser("user").password("password").roles("USER");
        }
 }

The configuration below is also the same as the above configuration.

 @Configuration
 @EnableWebSecurity
 public class RequestMatchersSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .requestMatchers()
                                .antMatchers("/api/**")
                                .and()
                         .requestMatchers()
                                .antMatchers("/oauth/**")
                                .and()
                        .authorizeRequests()
                                .antMatchers("/**").hasRole("USER")
                                .and()
                        .httpBasic();
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
                auth
                        .inMemoryAuthentication()
                                .withUser("user").password("password").roles("USER");
        }
 }

Returns:: the HttpSecurity.RequestMatcherConfigurer for further customizations

requestMatchers

public HttpSecurity requestMatchers(Customizer<HttpSecurity.RequestMatcherConfigurer> requestMatcherCustomizer)

Invoking requestMatchers() will not override previous invocations of mvcMatcher(String)}, requestMatchers(), antMatcher(String), regexMatcher(String), and requestMatcher(RequestMatcher).

Example Configurations

The following configuration enables the HttpSecurity for URLs that begin with "/api/" or "/oauth/".

 @Configuration
 @EnableWebSecurity
 public class RequestMatchersSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .requestMatchers(requestMatchers ->
                                requestMatchers
                                        .antMatchers("/api/**", "/oauth/**")
                        )
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .httpBasic(withDefaults());
        }
 }

The configuration below is the same as the previous configuration.

 @Configuration
 @EnableWebSecurity
 public class RequestMatchersSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .requestMatchers(requestMatchers ->
                                requestMatchers
                                        .antMatchers("/api/**")
                                        .antMatchers("/oauth/**")
                        )
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .httpBasic(withDefaults());
        }
 }

The configuration below is also the same as the above configuration.

 @Configuration
 @EnableWebSecurity
 public class RequestMatchersSecurityConfig extends WebSecurityConfigurerAdapter {

        @Override
        protected void configure(HttpSecurity http) throws Exception {
                http
                        .requestMatchers(requestMatchers ->
                                requestMatchers
                                        .antMatchers("/api/**")
                        )
                        .requestMatchers(requestMatchers ->
                        requestMatchers
                                .antMatchers("/oauth/**")
                        )
                        .authorizeRequests(authorizeRequests ->
                                authorizeRequests
                                        .antMatchers("/**").hasRole("USER")
                        )
                        .httpBasic(withDefaults());
        }
 }

Parameters:: requestMatcherCustomizer - the Customizer to provide more options for the HttpSecurity.RequestMatcherConfigurer
Returns:: the HttpSecurity for further customizations

requestMatcher
```
public HttpSecurity requestMatcher(RequestMatcher requestMatcher)
```
Allows configuring the HttpSecurity to only be invoked when matching the provided RequestMatcher. If more advanced configuration is necessary, consider using requestMatchers().
Invoking requestMatcher(RequestMatcher) will override previous invocations of requestMatchers(), mvcMatcher(String), antMatcher(String), regexMatcher(String), and requestMatcher(RequestMatcher).

Parameters:

requestMatcher - the RequestMatcher to use (i.e. new AntPathRequestMatcher("/admin/**","GET") )

Returns:

the HttpSecurity for further customizations

See Also:

requestMatchers(), antMatcher(String), regexMatcher(String)

antMatcher
```
public HttpSecurity antMatcher(java.lang.String antPattern)
```
Allows configuring the HttpSecurity to only be invoked when matching the provided ant pattern. If more advanced configuration is necessary, consider using requestMatchers() or requestMatcher(RequestMatcher).
Invoking antMatcher(String) will override previous invocations of mvcMatcher(String)}, requestMatchers(), antMatcher(String), regexMatcher(String), and requestMatcher(RequestMatcher).

Parameters:

antPattern - the Ant Pattern to match on (i.e. "/admin/**")

Returns:

the HttpSecurity for further customizations

See Also:

AntPathRequestMatcher

mvcMatcher
```
public HttpSecurity mvcMatcher(java.lang.String mvcPattern)
```
Allows configuring the HttpSecurity to only be invoked when matching the provided Spring MVC pattern. If more advanced configuration is necessary, consider using requestMatchers() or requestMatcher(RequestMatcher).
Invoking mvcMatcher(String) will override previous invocations of mvcMatcher(String)}, requestMatchers(), antMatcher(String), regexMatcher(String), and requestMatcher(RequestMatcher).

Parameters:

mvcPattern - the Spring MVC Pattern to match on (i.e. "/admin/**")

Returns:

the HttpSecurity for further customizations

See Also:

MvcRequestMatcher

regexMatcher
```
public HttpSecurity regexMatcher(java.lang.String pattern)
```
Allows configuring the HttpSecurity to only be invoked when matching the provided regex pattern. If more advanced configuration is necessary, consider using requestMatchers() or requestMatcher(RequestMatcher).
Invoking regexMatcher(String) will override previous invocations of mvcMatcher(String)}, requestMatchers(), antMatcher(String), regexMatcher(String), and requestMatcher(RequestMatcher).

Parameters:

pattern - the Regular Expression to match on (i.e. "/admin/.+")

Returns:

the HttpSecurity for further customizations

See Also:

RegexRequestMatcher

Class HttpSecurity

Example Usage

Nested Class Summary

Constructor Summary

Method Summary

Methods inherited from class org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder

Methods inherited from class org.springframework.security.config.annotation.AbstractSecurityBuilder

Methods inherited from class java.lang.Object

Methods inherited from interface org.springframework.security.config.annotation.web.HttpSecurityBuilder

Methods inherited from interface org.springframework.security.config.annotation.SecurityBuilder

Constructor Detail

HttpSecurity

Method Detail

openidLogin

Example Configurations

openidLogin

Example Configurations

headers

headers

Example Configurations

cors

cors

sessionManagement

Example Configuration

sessionManagement

Example Configuration

portMapper

Example Configuration

portMapper

Example Configuration

jee

Example Configuration

jee

Example Configuration

x509

Example Configuration

x509

Example Configuration

rememberMe

Example Configuration

rememberMe

Example Configuration

authorizeRequests

Example Configurations

authorizeRequests

Example Configurations

requestCache

requestCache

Example Custom Configuration

exceptionHandling

exceptionHandling

Example Custom Configuration

securityContext

securityContext

servletApi

servletApi

csrf

csrf

logout

Example Custom Configuration

logout

Example Custom Configuration

anonymous

Example Configuration

anonymous

Example Configuration

formLogin

Example Configurations

formLogin

Example Configurations

saml2Login

Example Configuration

saml2Login

Example Configuration

oauth2Login

Example Configuration

oauth2Login

Example Configuration

oauth2Client

oauth2Client