Spring Security: Configuring WebSecurity

Spring Security 5.4 also introduced the WebSecurityCustomizer.

The WebSecurityCustomizer is a callback interface that can be used to customize WebSecurity.

Below is an example configuration using the WebSecurityConfigurerAdapter that ignores requests that match /ignore1 or /ignore2:

@Configuration

public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override

    public void configure(WebSecurity web) {

        web.ignoring().antMatchers("/ignore1", "/ignore2");

    }

}

Going forward, the recommended way of doing this is registering a WebSecurityCustomizer bean:

@Configuration

public class SecurityConfiguration {

    @Bean

    public WebSecurityCustomizer webSecurityCustomizer() {

        return (web) -> web.ignoring().antMatchers("/ignore1", "/ignore2");

    }

}

WARNING: If you are configuring WebSecurity to ignore requests, consider using permitAll via HttpSecurity#authorizeHttpRequests instead. See the configure Javadoc for additional details.