[Spring] WebSecurityConfigurerAdapter Deprecated

 

https://spring.io/blog/2022/02/21/spring-security-without-the-websecurityconfigureradapter/

Spring Security without the WebSecurityConfigurerAdapter

 

WebSecurityConfigurerAdapter를 상속받아 설정하는 방식이 Deprecated되었다.

 

마이그레이션시 참고할것

 

 

구 방식 예시

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .cors()
            .and()
            .csrf().disable()
            .httpBasic().disable()
            .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            .and()
            .authorizeRequests()
             .antMatchers("/","/ex/**").permitAll()
             .anyRequest()
             .authenticated()
            .exceptionHandling().authenticationEntryPoint(new CustomAuthenticationEntryPoint())
             .and()
             .exceptionHandling().accessDeniedHandler(new CustomAccessDeniedHandler())
             .and()
             .addFilterBefore(new JwtAuthenticationFilter(this.userDetailsService, this.jwtTokenResolver),
              UsernamePasswordAuthenticationFilter.class)
            .addFilterAfter(jwtAuthenticationFilter, CorsFilter.class);
    }

}

 

 

Spring Security 6 이후 예시

 

@Bean
public SecurityFilterChain filterChain(final @NotNull HttpSecurity http) throws Exception {
		http	
			.cors(Customizer.withDefaults()) // 기본설정시 Customizer.withDefaults() 을 사용
			.csrf(CsrfConfigurer::disable)
			.httpBasic(HttpBasicConfigurer::disable)
			.sessionManagement(sessionManagement -> sessionManagement.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
			.authorizeHttpRequests(authorizeRequests -> authorizeRequests
				.requestMatchers("/", "/ex/**").permitAll()
				.anyRequest().authenticated())
        		.exceptionHandling(authenticationManager -> authenticationManager
                     		.authenticationEntryPoint(new CustomAuthenticationEntryPoint())
                     		.accessDeniedHandler(new CustomAccessDeniedHandler()))
        		.addFilterAfter(jwtAuthenticationFilter, CorsFilter.class);

		return http.build();
	}