Skip to content

WebSecurityConfigurerAdapter is deprecated #142

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

WebSecurityConfigurerAdapter is deprecated #142

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ad05eba
WebSecurityConfigurerAdapter is deprecated
Oct 9, 2022
ecadd82
WebSecurityConfigurerAdapter is deprecated
Oct 9, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 17 additions & 17 deletions click/README.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,36 +79,36 @@ WARNING: It's not a great idea to return a whole `OAuth2User` in an endpoint sin
There's one final change you'll need to make.

This app will now work fine and authenticate as before, but it's still going to redirect before showing the page.
To make the link visible, we also need to switch off the security on the home page by extending `WebSecurityConfigurerAdapter`:
To make the link visible, we also need to switch off the security on the home page by registering a SecurityFilterChain bean:

.SocialApplication
[source,java]
----
@SpringBootApplication
@RestController
public class SocialApplication extends WebSecurityConfigurerAdapter {
public class SocialApplication {

// ...

@Override
protected void configure(HttpSecurity http) throws Exception {
// @formatter:off
http
.authorizeRequests(a -> a
.antMatchers("/", "/error", "/webjars/**").permitAll()
.anyRequest().authenticated()
)
.exceptionHandling(e -> e
.authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
)
.oauth2Login();
// @formatter:on
}
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// @formatter:off
http
.authorizeRequests(a -> a
.antMatchers("/", "/error", "/webjars/**").permitAll()
.anyRequest().authenticated()
)
.exceptionHandling(e -> e
.authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
)
.oauth2Login();
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This method is marked as deprecated!

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think a viable solution (or at least workaround in the tutorial) would be

.oauth2Login(oauth -> oauth.loginPage("/index.html").permitAll())

return http.build();
// @formatter:on
}

}
----

Spring Boot attaches special meaning to a `WebSecurityConfigurerAdapter` on the class annotated with `@SpringBootApplication`:
It uses it to configure the security filter chain that carries the OAuth 2.0 authentication processor.

The above configuration indicates a whitelist of permitted endpoints, with every other endpoint requiring authentication.
Expand Down
27 changes: 14 additions & 13 deletions click/src/main/java/com/example/SocialApplication.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,37 +22,38 @@
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.http.HttpStatus;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.context.annotation.Bean;
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.security.oauth2.core.user.OAuth2User;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.HttpStatusEntryPoint;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@RestController
public class SocialApplication extends WebSecurityConfigurerAdapter {
public class SocialApplication {

@GetMapping("/user")
public Map<String, Object> user(@AuthenticationPrincipal OAuth2User principal) {
return Collections.singletonMap("name", principal.getAttribute("name"));
}

@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// @formatter:off
http
.authorizeRequests(a -> a
.antMatchers("/", "/error", "/webjars/**").permitAll()
.anyRequest().authenticated()
)
.exceptionHandling(e -> e
.authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
)
.oauth2Login();
.authorizeRequests(a -> a
.antMatchers("/", "/error", "/webjars/**").permitAll()
.anyRequest().authenticated()
)
.exceptionHandling(e -> e
.authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
)
.oauth2Login();
return http.build();
// @formatter:on
}

public static void main(String[] args) {
SpringApplication.run(SocialApplication.class, args);
}
Expand Down
12 changes: 6 additions & 6 deletions logout/README.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,13 +40,13 @@ Now we can switch over to the server side to implement that endpoint.
== Adding a Logout Endpoint

Spring Security has built in support for a `/logout` endpoint which will do the right thing for us (clear the session and invalidate the cookie).
To configure the endpoint we simply extend the existing `configure()` method in our `WebSecurityConfigurerAdapter`:
To configure the endpoint we simply extend the existing `filterChain()` bean:

.SocialApplication.java
[source,java]
----
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// @formatter:off
http
// ... existing code here
Expand All @@ -66,13 +66,13 @@ For instance, in Angular, the front end would like the server to send it a cooki
We can implement the same behaviour with our simple jQuery client, and then the server-side changes will work with other front end implementations with no or very few changes.
To teach Spring Security about this we need to add a filter that creates the cookie.

In the `WebSecurityConfigurerAdapter` we do the following:
In the `filterChain` bean we do the following:

.SocialApplication.java
[source,java]
----
@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// @formatter:off
http
// ... existing code here
Expand Down
10 changes: 6 additions & 4 deletions logout/src/main/java/com/example/SocialApplication.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,25 +22,26 @@
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.http.HttpStatus;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.context.annotation.Bean;
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.security.oauth2.core.user.OAuth2User;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.HttpStatusEntryPoint;
import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@RestController
public class SocialApplication extends WebSecurityConfigurerAdapter {
public class SocialApplication {

@RequestMapping("/user")
public Map<String, Object> user(@AuthenticationPrincipal OAuth2User principal) {
return Collections.singletonMap("name", principal.getAttribute("name"));
}

@Override
protected void configure(HttpSecurity http) throws Exception {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
// @formatter:off
http
.authorizeRequests(a -> a
Expand All @@ -57,6 +58,7 @@ protected void configure(HttpSecurity http) throws Exception {
.logoutSuccessUrl("/").permitAll()
)
.oauth2Login();
return http.build();
// @formatter:on
}

Expand Down