Scribd
Upload
2 views2 pages

New 21

The document outlines the transition from the old Spring Security configuration using WebSecurityConfigurerAdapter to the new approach with SecurityFilterChain bean in Spring Boot 3 and Spring Security 6. Key changes include using a lambda-style configuration for HttpSecurity and defining UserDetailsService as a bean for user management. It also highlights the use of {noop} for plain text passwords, which is not recommended for production environments.

Uploaded by

Prashant Awasthi
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
2 views2 pages

New 21

The document outlines the transition from the old Spring Security configuration using WebSecurityConfigurerAdapter to the new approach with SecurityFilterChain bean in Spring Boot 3 and Spring Security 6. Key changes include using a lambda-style configuration for HttpSecurity and defining UserDetailsService as a bean for user management. It also highlights the use of {noop} for plain text passwords, which is not recommended for production environments.

Uploaded by

Prashant Awasthi
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 2

You now configure security using a SecurityFilterChain bean and component-based

security configuration.

🔄 Example: Replacing WebSecurityConfigurerAdapter


Old Style (Spring Boot 2):
java
Copy
Edit
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.anyRequest().authenticated()
.and()
.httpBasic();
}
}
✅ New Style (Spring Boot 3 / Spring Security 6):
java
Copy
Edit
@Configuration
@EnableWebSecurity
public class SecurityConfig {

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws
Exception {
http
.authorizeHttpRequests(auth -> auth
.anyRequest().authenticated()
)
.httpBasic(); // or .formLogin();

return http.build();
}

@Bean
public UserDetailsService userDetailsService() {
UserDetails user = User.builder()
.username("admin")
.password("{noop}password") // {noop} for plain text (not recommended
for production)
.roles("USER")
.build();
return new InMemoryUserDetailsManager(user);
}
}
🔍 Key Changes
Concept Spring Security 5 (Old) Spring Security 6 (New)
Main config class WebSecurityConfigurerAdapter SecurityFilterChain bean
Override config configure(HttpSecurity) Lambda-style with http
User details In configure(AuthenticationManagerBuilder) Use
UserDetailsService bean
Password encoding NoOpPasswordEncoder.getInstance() {noop}password or
PasswordEncoder bean

You might also like