Spring Security Web Configurer Adapter

Question

guys. The code below is spring security web adapter. I do not like configure(HttpSecurity) method that generates security confirmation policy. Any ideas to do it more readable and clear?

/**
* Spring security configuration
*
* @author Eugene Ustimenko
* @date Nov 5, 2014
*/
@Configuration
@EnableWebSecurity
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

@Autowired
@Qualifier ("loginService")
private ILoginService loginService;

@Override
protected void configure (AuthenticationManagerBuilder auth)
  throws Exception {

auth.userDetailsService(loginService).passwordEncoder(passwordEncoder());
}


@Override
protected void configure (HttpSecurity http) throws Exception {

final RequestMatcher csrfRequestMatcher = new RequestMatcher() {

  private RegexRequestMatcher requestMatcher = new RegexRequestMatcher("/login/*", null);

  @Override
  public boolean matches (HttpServletRequest request) {

    return requestMatcher.matches(request);
  }
};
http.csrf()
    .requireCsrfProtectionMatcher(csrfRequestMatcher)
    .and().authorizeRequests().antMatchers("/admin/**").access("hasRole('ADMIN')")
    .and()
    .formLogin().loginPage("/login").failureUrl("/login?error")
    .usernameParameter("username").passwordParameter("password")
    .and()
    .logout().logoutSuccessUrl("/")
    .and()
    .csrf()
    .and()
    .exceptionHandling().accessDeniedPage("/403");
}

@Bean
public PasswordEncoder passwordEncoder () {

  final PasswordEncoder encoder = new BCryptPasswordEncoder();
  return encoder;
}

@Bean (name = "auth")
@Override
public AuthenticationManager authenticationManagerBean () throws Exception {

  return super.authenticationManagerBean();
}
}

Answer 1

You don't need to build this as one line. You could try splitting it out into multiple lines and add some comments to describe what you are doing.

I think the below example does what you want.

• I have removed the anonymous RequestMatcher class. RegexRequestMatcher implements the RequestMatcher interface.
• I have removed the second csrf() method call as it isn't needed.

@Override
protected void configure(final HttpSecurity http) throws Exception {

    // Enable csrf for login form
    http.csrf().requireCsrfProtectionMatcher(new RegexRequestMatcher("/login/*", null));
    // Configure login page
    http.formLogin().loginPage("/login").failureUrl("/login?error").usernameParameter("username").passwordParameter("password");
    // Configure logout redirect
    http.logout().logoutSuccessUrl("/");
    // Ensure admin pages have correct role
    http.authorizeRequests().antMatchers("/admin/**").hasRole("ADMIN");
    // Configure access denied exception redirect
    http.exceptionHandling().accessDeniedPage("/403");

}