guys. The code below is spring security web adapter. I do not like configure(HttpSecurity) method that generates security confirmation policy. Any ideas to do it more readable and clear?

* Spring security configuration
* @author Eugene Ustimenko
* @date Nov 5, 2014
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

@Qualifier ("loginService")
private ILoginService loginService;

protected void configure (AuthenticationManagerBuilder auth)
  throws Exception {


protected void configure (HttpSecurity http) throws Exception {

final RequestMatcher csrfRequestMatcher = new RequestMatcher() {

  private RegexRequestMatcher requestMatcher = new RegexRequestMatcher("/login/*", null);

  public boolean matches (HttpServletRequest request) {

    return requestMatcher.matches(request);

public PasswordEncoder passwordEncoder () {

  final PasswordEncoder encoder = new BCryptPasswordEncoder();
  return encoder;

@Bean (name = "auth")
public AuthenticationManager authenticationManagerBean () throws Exception {

  return super.authenticationManagerBean();

1 Answer 1


You don't need to build this as one line. You could try splitting it out into multiple lines and add some comments to describe what you are doing.

I think the below example does what you want.

  • I have removed the anonymous RequestMatcher class. RegexRequestMatcher implements the RequestMatcher interface.
  • I have removed the second csrf() method call as it isn't needed.

protected void configure(final HttpSecurity http) throws Exception {

    // Enable csrf for login form
    http.csrf().requireCsrfProtectionMatcher(new RegexRequestMatcher("/login/*", null));
    // Configure login page
    // Configure logout redirect
    // Ensure admin pages have correct role
    // Configure access denied exception redirect


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.