CODEWITHSUNDEEP
spring-security
user3629892
user3629892

Reputation: 3046

Difference between WebMvcConfigurer and WebSecurityConfigurerAdapter

What is the difference between those two? When do I use one over the other?

In the Spring Security Documentation it says that, among other things, WebMvcConfigurer has the following feature:

Require authentication to every URL in your application

The WebSecurityConfigurerAdapter example shown in HttpSecurity says:

Ensures that any request to our application requires the user to be authenticated.

Isn't that the same?

EDIT

These two types of configs seem to serve different purposes, I just don't quite understand yet, when to use which: What are the two distinct scenarios for each of the config types?

In the introduction to the HttpSecuriy section, it says

How does Spring Security know that we want to require all users to be authenticated? How does Spring Security know we want to support form based authentication?

So right now I am thinking: the first one says what should happen when authenticating a user and the second says in what cases do users need to be authenticated. Is that correct?

E.g., the first config "Generate a login form for you" and the second determines, when that login form should be shown?

Upvotes: 14

Views: 6731

Answers (1)

peater
peater

Reputation: 1273

This does appear to be a documentation bug (https://github.com/spring-projects/spring-security/issues/6809):

This raises confusion about the role of WebMvcConfigurer in Spring Security and the use cases for WebMvcConfigurer vs WebSecurityConfigurerAdapter.

Most likely the intention in the example was:

@EnableWebSecurity
public class WebSecurityConfig implements WebSecurityConfigurerAdapter {

instead of

@EnableWebSecurity
public class WebSecurityConfig implements WebMvcConfigurer {

Upvotes: 4

Related Questions