Solving WebSecurityConfigurerAdapter Deprecated Warning in Spring Boot 2.x

In the world of web development, security is a top priority. With the rise of cyber threats, developers need to take precautions to ensure that their applications are secure. One popular framework that developers use to build web applications is Spring Boot. However, with the release of Spring Boot 2.x, there have been some changes to the security configuration that have caused confusion among developers. In this blog, we will discuss how to solve the WebSecurityConfigurerAdapter deprecated warning in Spring Boot 2.x.

Understanding the Issue

The WebSecurityConfigurerAdapter class is an abstract class that provides a default implementation of the WebSecurityConfigurer interface. This interface allows developers to configure the security settings for their application. In Spring Boot 1.x, the WebSecurityConfigurerAdapter class was the recommended way to configure security settings. However, with the release of Spring Boot 2.x, this class has been deprecated.

Solution

To solve the WebSecurityConfigurerAdapter deprecated warning in Spring Boot 2.x, we need to make some changes to our code. The recommended way to configure security settings in Spring Boot 2.x is to use the new WebSecurityConfigurer interface.

Here are the steps to follow:

1. Create a new class that implements the WebSecurityConfigurer interface.

@Configuration
@EnableWebSecurity
public class SecurityConfig implements WebSecurityConfigurer {
    @Override
    public void configure(HttpSecurity http) throws Exception {
        // Configure security settings here
    }
}

2. Override the configure() method in the new class and specify the security settings for your application. For example, you can specify which URLs require authentication and which URLs are publicly accessible.

@Override
public void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
            .antMatchers("/public/**").permitAll()
            .anyRequest().authenticated()
            .and()
        .formLogin()
            .loginPage("/login")
            .permitAll()
            .and()
        .logout()
            .permitAll();
}

3. Annotate the new class with the @Configuration and @EnableWebSecurity annotations. The @Configuration annotation tells Spring that this class contains configuration information, and the @EnableWebSecurity annotation enables Spring Security for your application.

@Configuration
@EnableWebSecurity
public class SecurityConfig implements WebSecurityConfigurer {
    // Configuration settings here
}

Conclusion

In this blog, we discussed how to solve the WebSecurityConfigurerAdapter deprecated warning in Spring Boot 2.x. We learned that the recommended way to configure security settings in Spring Boot 2.x is to use the new WebSecurityConfigurer interface. We provided step-by-step instructions for implementing this solution in your code. By following these steps, you can ensure that your Spring Boot 2.x application is secure and protected against cyber threats.

Find example on our Github.