Spring Security: Upgrading the deprecated WebSecurityConfigurerAdapter (#12540)

* add SecurityFilterChain application in spring security web boot 4

* pmd violation

* fix: pom description

* remove unused code, format

* make tests grouped logically

* add missing case for user role

* rename package to lower case

spring-security-modules/spring-security-web-boot-4/src/main/java/com/baeldung/securityfilterchain/SecurityFilterChainApplication.java

@@ -0,0 +1,14 @@
+package com.baeldung.securityfilterchain;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.web.servlet.config.annotation.EnableWebMvc;
+
+@SpringBootApplication
+@EnableWebMvc
+public class SecurityFilterChainApplication {
+
+    public static void main(String[] args) {
+        SpringApplication.run(SecurityFilterChainApplication.class, args);
+    }
+}

spring-security-modules/spring-security-web-boot-4/src/main/java/com/baeldung/securityfilterchain/configuration/SecurityConfig.java

@@ -0,0 +1,50 @@
+package com.baeldung.securityfilterchain.configuration;
+
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.annotation.Bean;
+import org.springframework.http.HttpMethod;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
+import org.springframework.security.config.http.SessionCreationPolicy;
+import org.springframework.security.web.SecurityFilterChain;
+
+@EnableWebSecurity
+@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
+public class SecurityConfig {
+
+    @Value("${spring.security.debug:false}")
+    boolean securityDebug;
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+        http.csrf()
+          .disable()
+          .authorizeRequests()
+          .antMatchers(HttpMethod.DELETE)
+          .hasRole("ADMIN")
+          .antMatchers("/admin/**")
+          .hasAnyRole("ADMIN")
+          .antMatchers("/user/**")
+          .hasAnyRole("USER", "ADMIN")
+          .antMatchers("/login/**")
+          .anonymous()
+          .anyRequest()
+          .authenticated()
+          .and()
+          .httpBasic()
+          .and()
+          .sessionManagement()
+          .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
+
+        return http.build();
+    }
+
+    @Bean
+    public WebSecurityCustomizer webSecurityCustomizer() {
+        return (web) -> web.debug(securityDebug)
+          .ignoring()
+          .antMatchers("/css/**", "/js/**", "/img/**", "/lib/**", "/favicon.ico");
+    }
+}

spring-security-modules/spring-security-web-boot-4/src/main/java/com/baeldung/securityfilterchain/configuration/UserDetailServiceConfig.java

@@ -0,0 +1,31 @@
+package com.baeldung.securityfilterchain.configuration;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.core.userdetails.User;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.provisioning.InMemoryUserDetailsManager;
+
+@Configuration
+public class UserDetailServiceConfig {
+
+    @Bean
+    public UserDetailsService userDetailsService(BCryptPasswordEncoder bCryptPasswordEncoder) {
+        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
+        manager.createUser(User.withUsername("user")
+          .password(bCryptPasswordEncoder.encode("userPass"))
+          .roles("USER")
+          .build());
+        manager.createUser(User.withUsername("admin")
+          .password(bCryptPasswordEncoder.encode("adminPass"))
+          .roles("ADMIN", "USER")
+          .build());
+        return manager;
+    }
+
+    @Bean
+    public BCryptPasswordEncoder bCryptPasswordEncoder() {
+        return new BCryptPasswordEncoder();
+    }
+}

spring-security-modules/spring-security-web-boot-4/src/main/java/com/baeldung/securityfilterchain/controller/ResourceController.java

@@ -0,0 +1,34 @@
+package com.baeldung.securityfilterchain.controller;
+
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+public class ResourceController {
+    @GetMapping("/login")
+    public String loginEndpoint() {
+        return "Login!";
+    }
+
+    @GetMapping("/admin")
+    public String adminEndpoint() {
+        return "Admin!";
+    }
+
+    @GetMapping("/user")
+    public String userEndpoint() {
+        return "User!";
+    }
+
+    @GetMapping("/all")
+    public String allRolesEndpoint() {
+        return "All Roles!";
+    }
+
+    @DeleteMapping("/delete")
+    public String deleteEndpoint(@RequestBody String s) {
+        return "I am deleting " + s;
+    }
+}