在没有AbstractSecurityWebApplicationInitializer的情况下启用Spring Security

Question

I have a Spring based web application (not Spring boot) and I'm trying to enable Spring Security.

I can enable it by extending AbstractSecurityWebApplicationInitializer and it works fine. However I want to do it using @EnableWebSecurity , without extending AbstractSecurityWebApplicationInitializer . But this annotation alone cannot enable it. Is there a way to achieve that or does this annotation alone solution works only for Spring Boot?

Thanks.

Answer 1

In a non-Boot environment, you are probably using a dispatcher servlet initializer class, for example, extending the AbstractAnnotationConfigDispatcherServletInitializer . You can register the security filter chain like this:

private static void initSecurityFilter(ServletContext servletContext) {
   FilterRegistration.Dynamic securityFilter = servletContext.addFilter("springSecurityFilterChain",
                DelegatingFilterProxy.class);
   final EnumSet<DispatcherType> es = EnumSet.of(DispatcherType.REQUEST, DispatcherType.FORWARD);
   securityFilter.addMappingForUrlPatterns(es, true, "/*");
}

and invoke it from onStartup .