JAVA-27657 | Replacing deprecated WebSecurityConfigurerAdapter

spring-security-modules/spring-security-core-2/src/main/java/com/baeldung/httpsecurityvswebsecurity/HttpSecurityConfig.java

@@ -1,16 +1,17 @@
 package com.baeldung.httpsecurityvswebsecurity;
 
+import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.SecurityFilterChain;
 
 @Configuration
 @EnableWebSecurity
-public class HttpSecurityConfig extends WebSecurityConfigurerAdapter {
+public class HttpSecurityConfig {
 
-    @Override
-    protected void configure(HttpSecurity http) throws Exception {
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
         // Given: HttpSecurity configured
 
         http.authorizeRequests()
@@ -27,5 +28,6 @@ public class HttpSecurityConfig extends WebSecurityConfigurerAdapter {
 
         // When: Accessing specific URLs
         // Then: Access is granted based on defined rules
+        return http.build();
     }
 }

spring-security-modules/spring-security-core-2/src/main/java/com/baeldung/httpsecurityvswebsecurity/WebSecurityConfig.java

@@ -1,35 +1,48 @@
 package com.baeldung.httpsecurityvswebsecurity;
 
+import org.springframework.context.annotation.Bean;
+import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.web.SecurityFilterChain;
 
 @Configuration
-public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
+public class WebSecurityConfig {
 
     @Autowired
     private UserDetailsService userDetailsService;
 
-    @Override
-    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-        auth
-          .userDetailsService(userDetailsService)
-          .passwordEncoder(new BCryptPasswordEncoder());
+    @Bean
+    public BCryptPasswordEncoder bCryptPasswordEncoder() {
+        return new BCryptPasswordEncoder();
     }
 
-    @Override
-    protected void configure(HttpSecurity http) throws Exception {
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+
+        AuthenticationManagerBuilder authenticationManagerBuilder = http.getSharedObject(AuthenticationManagerBuilder.class);
+        authenticationManagerBuilder.userDetailsService(userDetailsService);
+        AuthenticationManager authenticationManager = authenticationManagerBuilder.build();
+
         http.authorizeRequests()
-          .antMatchers("/")
-          .permitAll()
-          .anyRequest()
-          .authenticated()
-          .and()
-          .formLogin();
+            .antMatchers("/")
+            .permitAll()
+            .anyRequest()
+            .authenticated()
+            .and()
+            .formLogin().and()
+            .authenticationManager(authenticationManager)
+            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
+
+        return http.build();
+    }
+
+    protected void configure(HttpSecurity http) throws Exception {
+
     }
 }