From 688005d0c50288bb16ae677273e7e893f4a234fc Mon Sep 17 00:00:00 2001 From: anuragkumawat Date: Thu, 21 Mar 2024 02:50:40 +0530 Subject: [PATCH] JAVA-29313 Upgrade spring-security-web-mvc-custom to spring-6 (#16152) --- .../spring-security-web-mvc-custom/pom.xml | 27 ++++++++------- ...SimpleUrlAuthenticationSuccessHandler.java | 6 ++-- .../baeldung/spring/MyUserDetailsService.java | 2 +- .../baeldung/spring/SecSecurityConfig.java | 32 +++++++----------- .../web/controller/FooController.java | 2 +- .../web/controller/LoginController.java | 9 +++-- .../web/interceptor/LoggerInterceptor.java | 4 +-- .../interceptor/SessionTimerInterceptor.java | 6 ++-- .../web/interceptor/UserInterceptor.java | 6 ++-- .../csrf/CsrfAbstractIntegrationTest.java | 2 +- .../security/spring/ManualSecurityConfig.java | 29 +++++++--------- .../spring/ManualSecurityIntegrationTest.java | 2 +- .../spring/SecurityWithCsrfConfig.java | 24 +++++++------- .../spring/SecurityWithCsrfCookieConfig.java | 30 +++++++---------- .../spring/SecurityWithoutCsrfConfig.java | 33 ++++++++----------- ...essionTimerInterceptorIntegrationTest.java | 2 +- 16 files changed, 96 insertions(+), 120 deletions(-) diff --git a/spring-security-modules/spring-security-web-mvc-custom/pom.xml b/spring-security-modules/spring-security-web-mvc-custom/pom.xml index 41f24050b2..7f7f256196 100644 --- a/spring-security-modules/spring-security-web-mvc-custom/pom.xml +++ b/spring-security-modules/spring-security-web-mvc-custom/pom.xml @@ -10,9 +10,9 @@ com.baeldung - parent-spring-5 + parent-spring-6 0.0.1-SNAPSHOT - ../../parent-spring-5 + ../../parent-spring-6 @@ -86,15 +86,15 @@ - javax.servlet - javax.servlet-api - ${javax.servlet-api.version} + jakarta.servlet + jakarta.servlet-api + ${jakarta.servlet-api.version} provided - javax.servlet - jstl - ${jstl.version} + jakarta.servlet.jsp.jstl + jakarta.servlet.jsp.jstl-api + ${jakarta.jstl-api.version} runtime @@ -127,9 +127,9 @@ test - javax.annotation - javax.annotation-api - ${javax.annotation-api.version} + jakarta.annotation + jakarta.annotation-api + ${jakarta.annotation-api.version} @@ -173,7 +173,10 @@ 1.6.1 - 1.3.2 + 3.0.0-M1 + 6.1.0-M1 + 3.0.0 + 6.2.1 \ No newline at end of file diff --git a/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/security/MySimpleUrlAuthenticationSuccessHandler.java b/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/security/MySimpleUrlAuthenticationSuccessHandler.java index 728445952e..9422e7032d 100644 --- a/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/security/MySimpleUrlAuthenticationSuccessHandler.java +++ b/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/security/MySimpleUrlAuthenticationSuccessHandler.java @@ -5,9 +5,9 @@ import java.util.Collection; import java.util.HashMap; import java.util.Map; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpServletResponse; +import jakarta.servlet.http.HttpSession; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; diff --git a/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/spring/MyUserDetailsService.java b/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/spring/MyUserDetailsService.java index ee80ad12d7..9cf0779e73 100644 --- a/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/spring/MyUserDetailsService.java +++ b/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/spring/MyUserDetailsService.java @@ -7,7 +7,7 @@ import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.stereotype.Service; -import javax.annotation.PostConstruct; +import jakarta.annotation.PostConstruct; import java.util.*; @Service diff --git a/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/spring/SecSecurityConfig.java b/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/spring/SecSecurityConfig.java index d5e83a1110..d228dec49f 100644 --- a/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/spring/SecSecurityConfig.java +++ b/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/spring/SecSecurityConfig.java @@ -6,6 +6,7 @@ import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; +import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.provisioning.InMemoryUserDetailsManager; @@ -40,29 +41,20 @@ public class SecSecurityConfig { @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { - http.authorizeRequests() - .antMatchers("/anonymous*") + http.authorizeHttpRequests(auth -> auth.requestMatchers("/anonymous*") .anonymous() - .antMatchers("/login*") + .requestMatchers("/login*") .permitAll() .anyRequest() - .authenticated() - .and() - .formLogin() - .loginPage("/login.html") - .loginProcessingUrl("/login") - .successHandler(myAuthenticationSuccessHandler()) - .failureUrl("/login.html?error=true") - .and() - .logout() - .deleteCookies("JSESSIONID") - .and() - .rememberMe() - .key("uniqueAndSecret") - .tokenValiditySeconds(86400) - .and() - .csrf() - .disable(); + .authenticated()) + .formLogin(formLogin -> formLogin.loginPage("/login.html") + .loginProcessingUrl("/login") + .successHandler(myAuthenticationSuccessHandler()) + .failureUrl("/login.html?error=true")) + .rememberMe(rememberMe -> rememberMe.key("uniqueAndSecret") + .tokenValiditySeconds(86400)) + .logout(logout -> logout.deleteCookies("JSESSIONID")) + .csrf(AbstractHttpConfigurer::disable); return http.build(); } diff --git a/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/controller/FooController.java b/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/controller/FooController.java index 6f9268c976..8d5016cdc4 100644 --- a/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/controller/FooController.java +++ b/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/controller/FooController.java @@ -5,7 +5,7 @@ import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic; import java.util.Arrays; import java.util.List; -import javax.servlet.http.HttpServletResponse; +import jakarta.servlet.http.HttpServletResponse; import com.baeldung.web.dto.Foo; import org.springframework.beans.factory.annotation.Autowired; diff --git a/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/controller/LoginController.java b/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/controller/LoginController.java index 8a823cdf7e..5f73f9ea8f 100644 --- a/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/controller/LoginController.java +++ b/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/controller/LoginController.java @@ -1,10 +1,5 @@ package com.baeldung.web.controller; -import javax.annotation.Resource; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpSession; - -import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.Authentication; @@ -15,6 +10,10 @@ import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RequestParam; +import jakarta.annotation.Resource; +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpSession; + @Controller @RequestMapping(value = "/custom") public class LoginController { diff --git a/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/interceptor/LoggerInterceptor.java b/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/interceptor/LoggerInterceptor.java index 669e4cb3c5..78f3de6c20 100644 --- a/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/interceptor/LoggerInterceptor.java +++ b/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/interceptor/LoggerInterceptor.java @@ -2,8 +2,8 @@ package com.baeldung.web.interceptor; import java.util.Enumeration; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpServletResponse; import org.slf4j.Logger; import org.slf4j.LoggerFactory; diff --git a/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/interceptor/SessionTimerInterceptor.java b/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/interceptor/SessionTimerInterceptor.java index e7decc262f..d914b564fe 100644 --- a/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/interceptor/SessionTimerInterceptor.java +++ b/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/interceptor/SessionTimerInterceptor.java @@ -1,8 +1,8 @@ package com.baeldung.web.interceptor; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpServletResponse; +import jakarta.servlet.http.HttpSession; import org.slf4j.Logger; import org.slf4j.LoggerFactory; diff --git a/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/interceptor/UserInterceptor.java b/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/interceptor/UserInterceptor.java index ad80571be6..152d9f9864 100644 --- a/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/interceptor/UserInterceptor.java +++ b/spring-security-modules/spring-security-web-mvc-custom/src/main/java/com/baeldung/web/interceptor/UserInterceptor.java @@ -1,8 +1,8 @@ package com.baeldung.web.interceptor; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; -import javax.servlet.http.HttpSession; +import jakarta.servlet.http.HttpServletRequest; +import jakarta.servlet.http.HttpServletResponse; +import jakarta.servlet.http.HttpSession; import org.slf4j.Logger; import org.slf4j.LoggerFactory; diff --git a/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/csrf/CsrfAbstractIntegrationTest.java b/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/csrf/CsrfAbstractIntegrationTest.java index 97972b7358..fc289015a7 100644 --- a/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/csrf/CsrfAbstractIntegrationTest.java +++ b/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/csrf/CsrfAbstractIntegrationTest.java @@ -3,7 +3,7 @@ package com.baeldung.security.csrf; import static org.apache.commons.lang3.RandomStringUtils.randomAlphabetic; import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user; -import javax.servlet.Filter; +import jakarta.servlet.Filter; import com.baeldung.web.dto.Foo; import org.junit.Before; diff --git a/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/ManualSecurityConfig.java b/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/ManualSecurityConfig.java index d2553ac2a8..0aba57ea73 100644 --- a/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/ManualSecurityConfig.java +++ b/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/ManualSecurityConfig.java @@ -3,11 +3,13 @@ package com.baeldung.security.spring; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationManager; +import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; -import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; +import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer; +import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.provisioning.InMemoryUserDetailsManager; @@ -15,7 +17,7 @@ import org.springframework.security.web.SecurityFilterChain; @Configuration @EnableWebSecurity -@EnableGlobalMethodSecurity(prePostEnabled = true) +@EnableMethodSecurity public class ManualSecurityConfig { @Bean @@ -34,7 +36,7 @@ public class ManualSecurityConfig { @Bean public WebSecurityCustomizer webSecurityCustomizer() { return (web) -> web.ignoring() - .antMatchers("/resources/**"); + .requestMatchers("/resources/**"); } @Bean @@ -45,20 +47,13 @@ public class ManualSecurityConfig { @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { - http.authorizeRequests() - .mvcMatchers("/custom/login") - .permitAll() - .anyRequest() - .authenticated() - .and() - .httpBasic() - .and() - .headers() - .cacheControl() - .disable() - .and() - .csrf() - .disable(); + http.csrf(AbstractHttpConfigurer::disable) + .httpBasic(Customizer.withDefaults()) + .headers(headers -> headers.cacheControl((cacheControl) -> cacheControl.disable())) + .authorizeHttpRequests(auth -> auth.requestMatchers("/custom/login") + .permitAll() + .anyRequest() + .authenticated()); return http.build(); } diff --git a/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/ManualSecurityIntegrationTest.java b/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/ManualSecurityIntegrationTest.java index 002ba8df3e..bf21c3a402 100644 --- a/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/ManualSecurityIntegrationTest.java +++ b/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/ManualSecurityIntegrationTest.java @@ -3,7 +3,7 @@ package com.baeldung.security.spring; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; -import javax.servlet.http.HttpSession; +import jakarta.servlet.http.HttpSession; import com.baeldung.spring.MvcConfig; import org.junit.Before; diff --git a/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/SecurityWithCsrfConfig.java b/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/SecurityWithCsrfConfig.java index a1a7c8bc54..a1070be9cd 100644 --- a/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/SecurityWithCsrfConfig.java +++ b/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/SecurityWithCsrfConfig.java @@ -3,11 +3,14 @@ package com.baeldung.security.spring; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationManager; +import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; +import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer; +import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.provisioning.InMemoryUserDetailsManager; @@ -15,7 +18,7 @@ import org.springframework.security.web.SecurityFilterChain; @Configuration @EnableWebSecurity -@EnableGlobalMethodSecurity(prePostEnabled = true) +@EnableMethodSecurity public class SecurityWithCsrfConfig { @Bean @@ -40,22 +43,17 @@ public class SecurityWithCsrfConfig { @Bean public WebSecurityCustomizer webSecurityCustomizer() { return (web) -> web.ignoring() - .antMatchers("/resources/**"); + .requestMatchers("/resources/**"); } @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { - http.authorizeRequests() - .antMatchers("/auth/admin/*") - .hasAnyRole("ROLE_ADMIN") - .anyRequest() - .authenticated() - .and() - .httpBasic() - .and() - .headers() - .cacheControl() - .disable(); + http.httpBasic(Customizer.withDefaults()) + .headers(headers -> headers.cacheControl((cacheControl) -> cacheControl.disable())) + .authorizeHttpRequests(auth -> auth.requestMatchers("/auth/admin/*") + .hasAnyRole("ADMIN") + .anyRequest() + .authenticated()); return http.build(); } diff --git a/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/SecurityWithCsrfCookieConfig.java b/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/SecurityWithCsrfCookieConfig.java index a34fa4c704..d10606eba0 100644 --- a/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/SecurityWithCsrfCookieConfig.java +++ b/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/SecurityWithCsrfCookieConfig.java @@ -3,8 +3,9 @@ package com.baeldung.security.spring; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationManager; +import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; -import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; +import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer; @@ -16,7 +17,7 @@ import org.springframework.security.web.csrf.CookieCsrfTokenRepository; @Configuration @EnableWebSecurity -@EnableGlobalMethodSecurity(prePostEnabled = true) +@EnableMethodSecurity public class SecurityWithCsrfCookieConfig { @Bean @@ -41,26 +42,19 @@ public class SecurityWithCsrfCookieConfig { @Bean public WebSecurityCustomizer webSecurityCustomizer() { return (web) -> web.ignoring() - .antMatchers("/resources/**"); + .requestMatchers("/resources/**"); } @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { - http.authorizeRequests() - .antMatchers("/auth/admin/*") - .hasAnyRole("ROLE_ADMIN") - .anyRequest() - .authenticated() - .and() - .httpBasic() - .and() - .headers() - .cacheControl() - .disable() - // Stateless API CSRF configuration - .and() - .csrf() - .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()); + // Stateless API CSRF configuration + http.csrf(csrf -> csrf.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())) + .httpBasic(Customizer.withDefaults()) + .headers(headers -> headers.cacheControl((cacheControl) -> cacheControl.disable())) + .authorizeHttpRequests(auth -> auth.requestMatchers("/auth/admin/*") + .hasAnyRole("ADMIN") + .anyRequest() + .authenticated()); return http.build(); } diff --git a/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/SecurityWithoutCsrfConfig.java b/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/SecurityWithoutCsrfConfig.java index 20df0f4d6d..a70c71f3b4 100644 --- a/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/SecurityWithoutCsrfConfig.java +++ b/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/security/spring/SecurityWithoutCsrfConfig.java @@ -3,11 +3,13 @@ package com.baeldung.security.spring; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationManager; +import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; -import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; +import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer; +import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.provisioning.InMemoryUserDetailsManager; @@ -15,7 +17,7 @@ import org.springframework.security.web.SecurityFilterChain; @Configuration @EnableWebSecurity -@EnableGlobalMethodSecurity(prePostEnabled = true) +@EnableMethodSecurity public class SecurityWithoutCsrfConfig { @Bean @@ -28,11 +30,11 @@ public class SecurityWithoutCsrfConfig { public InMemoryUserDetailsManager userDetailsService() { UserDetails user = User.withUsername("user1") .password("user1Pass") - .authorities("ROLE_USER") + .authorities("USER") .build(); UserDetails admin = User.withUsername("admin") .password("adminPass") - .authorities("ROLE_ADMIN") + .authorities("ADMIN") .build(); return new InMemoryUserDetailsManager(user, admin); } @@ -40,25 +42,18 @@ public class SecurityWithoutCsrfConfig { @Bean public WebSecurityCustomizer webSecurityCustomizer() { return (web) -> web.ignoring() - .antMatchers("/resources/**"); + .requestMatchers("/resources/**"); } @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { - http.authorizeRequests() - .antMatchers("/auth/admin/*") - .hasAnyRole("ROLE_ADMIN") - .anyRequest() - .authenticated() - .and() - .httpBasic() - .and() - .headers() - .cacheControl() - .disable() - .and() - .csrf() - .disable(); + http.csrf(AbstractHttpConfigurer::disable) + .httpBasic(Customizer.withDefaults()) + .headers(headers -> headers.cacheControl((cacheControl) -> cacheControl.disable())) + .authorizeHttpRequests(auth -> auth.requestMatchers("/auth/admin/*") + .hasAnyRole("ADMIN") + .anyRequest() + .authenticated()); return http.build(); } diff --git a/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/web/interceptor/SessionTimerInterceptorIntegrationTest.java b/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/web/interceptor/SessionTimerInterceptorIntegrationTest.java index 873c28c6a2..c17769e081 100644 --- a/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/web/interceptor/SessionTimerInterceptorIntegrationTest.java +++ b/spring-security-modules/spring-security-web-mvc-custom/src/test/java/com/baeldung/web/interceptor/SessionTimerInterceptorIntegrationTest.java @@ -3,7 +3,7 @@ package com.baeldung.web.interceptor; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; -import javax.servlet.http.HttpSession; +import jakarta.servlet.http.HttpSession; import com.baeldung.security.spring.SecurityWithoutCsrfConfig; import com.baeldung.spring.MvcConfig;