Spring Security real dry: custom configuration WebSecurityConfigurerAdapter class entry

1. Introduction

Today we are going to further study how the custom configure Spring Security we have repeatedly mentioned WebSecurityConfigurerAdapter, And we know the Spring automatic configuration of the Boot is actually passed under the automatic configuration package SecurityAutoConfiguration total configuration class imported Spring Boot Web security configuration classes SpringBootWebSecurityConfiguration to configuration. So we took it out. If you are still confused, check out Spring Security at https://felord.cn.

2. Customize the Spring Boot Web security configuration class

We use our best Ctrl + C and Ctrl + V to copy the source code of SpringBootWebSecurityConfiguration, We custom CustomSpringBootWebSecurityConfiguration named:

@Configuration @ConditionalOnClass(WebSecurityConfigurerAdapter.class) @ConditionalOnWebApplication(type = ConditionalOnWebApplication.Type.SERVLET) public class CustomSpringBootWebSecurityConfiguration { @Configuration @Order(SecurityProperties.BASIC_AUTH_ORDER) static class DefaultConfigurerAdapter extends WebSecurityConfigurerAdapter {  @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { super.configure(auth); } @Override public void configure(WebSecurity web) throws Exception { super.configure(web); } @Override protected void configure(HttpSecurity http) throws Exception { super.configure(http); }}}Copy the code

Some of you may have noticed that I overrode (@override) the three methods in the DefaultConfigurerAdapter above. We usually customize our secure access policies by customizing these three methods.

2.1 Authentication Manager Configuration Method

Void the configure (AuthenticationManagerBuilder auth) used to configure the authentication manager the AuthenticationManager. It handles all UserDetails, including the PasswordEncoder. You can use UserDetail in Spring Security if you don’t know. AuthenticationManager is not covered in this article, there will be a special article on it later. Can be learned through the Spring Security Practice series.

2.2 Core Filter Configuration Method

Void configure(WebSecurity web) configures WebSecurity. The WebSecurity is based on the Servlet Filter used to configure springSecurityFilterChain. And springSecurityFilterChain is delegated to the Spring Security core filter Bean DelegatingFilterProxy. You can find the logic in WebSecurityConfiguration. Ignoring () we generally don’t customize WebSecurity too much, and use the ignoring() method instead to ignore Spring Security’s control of static resources.

2.3 Security Filter Chain Configuration method

Void configure(HttpSecurity HTTP) This is the one we use most, to configure HttpSecurity. HttpSecurity is used to build a SecurityFilterChain SecurityFilterChain. The SecurityFilterChain is finally injected into the core filter. HttpSecurity has a number of configurations that we need. We can use it to customize security access policies. So let’s do a separate chapter on this thing.

3. HttpSecurity configuration

HttpSecurity will be the focus of the next few articles, and we’ll actually use it to implement some utility features. So this paper will focus on it.

3.1 Default Configuration

      protected void configure(HttpSecurity http) throws Exception {
          logger.debug("Using default configure(HttpSecurity). If subclassed this will potentially override subclass configure(HttpSecurity).");
  
          http
              .authorizeRequests()
                  .anyRequest().authenticated()
                  .and()
              .formLogin().and()
              .httpBasic();
      }Copy the code

The above is the default configuration of Spring Security in Spring Boot. With the above configuration, your application has the following functions:

• All requested access needs to be authorized.
• useformForm to log in (default path is/login), the landing page we’ve seen in the last few posts.
• To preventCSRFThe attack,XSSAttack.
• To enable theHTTP Basiccertification

3.2 Interpretation of common methods

HttpSecurity uses the Builder construction method to flexibly formulate access policies. HttpSecurity was first configured based on XML tags. JavaConfig is now mostly used. The commonly used methods are interpreted as follows:

4. To summarize

So far, we’ve learned a lot about Spring Security from the beginning to the end. We have started to customize to achieve some practical functions, in the later articles we will combine the actual development scenarios for some practical operations. Please follow the public account “Felordcn” for the first time to get related tutorials.

Follow our public id: Felordcn for more information

Personal blog: https://felord.cn