CODEWITHSUNDEEP
javaspringspring-mvcspring-security
Mike R
Mike R

Reputation: 4538

What is the difference between @EnableWebSecurity and @EnableWebMvcSecurity?

@EnableWebSecurity

The JavaDoc documentaion:

Add this annotation to an @Configuration class to have the Spring Security configuration defined in any WebSecurityConfigurer or more likely by extending the WebSecurityConfigurerAdapter base class and overriding individual methods.

@EnableWebMvcSecurity

The JavaDoc documentaion:

Add this annotation to an @Configuration class to have the Spring Security configuration integrate with Spring MVC.

Upvotes: 49

Views: 31521

Answers (2)

Cassian
Cassian

Reputation: 3738

As of Spring Security 4.0, @EnableWebMvcSecurity is deprecated. The replacement is @EnableWebSecurity which will determine adding the Spring MVC features based upon the classpath.

To enable Spring Security integration with Spring MVC add the @EnableWebSecurity annotation to your configuration.

source

Upvotes: 56

Steve
Steve

Reputation: 9480

If you take a look at those classes, @EnableWebMvcSecurity actually adds the @EnableWebSecurity annotation in WebMvcSecurityConfiguration. Therefore, @EnableWebMvcSecurity does everything that @EnableWebSecurity does, and a bit more.

What more you ask?

If you look at WebMvcSecurityConfiguration, you will see that it adds an AuthenticationPrincipalArgumentResolver so that you can access the authentication principal by adding an annotation to a controller method argument. i.e.:

public String show(@AuthenticationPrincipal CustomUser customUser) {
    // do something with CustomUser
    return "view";
}

It also integrates with Spring Web MVC to add a CSRF token to forms.

Upvotes: 42

Related Questions