Fix Add @configuration to @enable*Security Usage

rwinch · rwinch · commit a5069d7e3511 · 2022-08-09T17:00:16.000-05:00
Issue gh-6613
diff --git a/config/src/integration-test/java/org/springframework/security/config/annotation/authentication/ldap/LdapAuthenticationProviderBuilderSecurityBuilderTests.java b/config/src/integration-test/java/org/springframework/security/config/annotation/authentication/ldap/LdapAuthenticationProviderBuilderSecurityBuilderTests.java
@@ -189,6 +189,7 @@ protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 
 	}
 
+	@Configuration
 	@EnableWebSecurity
 	static class GroupSearchConfig extends BaseLdapProviderConfig {
 
diff --git a/config/src/main/java/org/springframework/security/config/annotation/rsocket/RSocketSecurity.java b/config/src/main/java/org/springframework/security/config/annotation/rsocket/RSocketSecurity.java
@@ -55,6 +55,7 @@
  * A minimal example can be found below:
  *
  * <pre class="code">
+ * &#064;Configuration
  * &#064;EnableRSocketSecurity
  * public class SecurityConfig {
  *     &#064;Bean
@@ -82,6 +83,7 @@
  * A more advanced configuration can be seen below:
  *
  * <pre class="code">
+ * &#064;Configuration
  * &#064;EnableRSocketSecurity
  * public class SecurityConfig {
  *     &#064;Bean
diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/servlet/configuration/EnableWebMvcSecurity.java b/config/src/main/java/org/springframework/security/config/annotation/web/servlet/configuration/EnableWebMvcSecurity.java
@@ -22,7 +22,6 @@
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
-import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
 import org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication;
 
@@ -39,7 +38,6 @@
 @Documented
 @Import(WebMvcSecurityConfiguration.class)
 @EnableGlobalAuthentication
-@Configuration
 @Deprecated
 public @interface EnableWebMvcSecurity {
 
diff --git a/config/src/test/java/org/springframework/security/config/annotation/issue50/SecurityConfig.java b/config/src/test/java/org/springframework/security/config/annotation/issue50/SecurityConfig.java
@@ -39,9 +39,9 @@
  * @author Rob Winch
  *
  */
+@Configuration
 @EnableWebSecurity
 @EnableGlobalMethodSecurity(prePostEnabled = true)
-@Configuration
 public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
 	@Autowired
diff --git a/config/src/test/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfigurationTests.java b/config/src/test/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfigurationTests.java
@@ -531,8 +531,8 @@ Authz authz() {
 
 	}
 
-	@EnableGlobalMethodSecurity(prePostEnabled = true)
 	@Configuration
+	@EnableGlobalMethodSecurity(prePostEnabled = true)
 	public static class RoleHierarchyConfig {
 
 		@Bean
@@ -607,8 +607,8 @@ void emptyPrefixRoleUser() {
 
 	}
 
-	@EnableGlobalMethodSecurity(prePostEnabled = true)
 	@Configuration
+	@EnableGlobalMethodSecurity(prePostEnabled = true)
 	public static class CustomMetadataSourceBeanProxyEnabledConfig extends GlobalMethodSecurityConfiguration {
 
 	}
diff --git a/config/src/test/java/org/springframework/security/config/annotation/method/configuration/NamespaceGlobalMethodSecurityTests.java b/config/src/test/java/org/springframework/security/config/annotation/method/configuration/NamespaceGlobalMethodSecurityTests.java
@@ -316,8 +316,8 @@ protected AuthenticationManager authenticationManager() {
 
 	}
 
-	@EnableGlobalMethodSecurity(jsr250Enabled = true)
 	@Configuration
+	@EnableGlobalMethodSecurity(jsr250Enabled = true)
 	public static class Jsr250Config {
 
 	}
diff --git a/config/src/test/java/org/springframework/security/config/annotation/web/configurers/AnonymousConfigurerTests.java b/config/src/test/java/org/springframework/security/config/annotation/web/configurers/AnonymousConfigurerTests.java
@@ -127,6 +127,7 @@ protected void configure(HttpSecurity http) throws Exception {
 
 	}
 
+	@Configuration
 	@EnableWebSecurity
 	static class AnonymousDisabledInLambdaConfig extends WebSecurityConfigurerAdapter {
 
diff --git a/config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceHttpFormLoginTests.java b/config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceHttpFormLoginTests.java
@@ -131,6 +131,7 @@ protected void configure(HttpSecurity http) throws Exception {
 
 	}
 
+	@Configuration
 	@EnableWebSecurity
 	static class FormLoginCustomConfig extends WebSecurityConfigurerAdapter {
 
diff --git a/config/src/test/java/org/springframework/security/config/annotation/web/configurers/X509ConfigurerTests.java b/config/src/test/java/org/springframework/security/config/annotation/web/configurers/X509ConfigurerTests.java
@@ -26,6 +26,7 @@
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
 import org.springframework.core.io.ClassPathResource;
 import org.springframework.security.config.annotation.ObjectPostProcessor;
 import org.springframework.security.config.annotation.SecurityContextChangedListenerConfig;
@@ -151,6 +152,7 @@ private <T extends Certificate> T loadCert(String location) {
 		}
 	}
 
+	@Configuration
 	@EnableWebSecurity
 	static class ObjectPostProcessorConfig extends WebSecurityConfigurerAdapter {
 
@@ -180,6 +182,7 @@ public <O> O postProcess(O object) {
 
 	}
 
+	@Configuration
 	@EnableWebSecurity
 	static class DuplicateDoesNotOverrideConfig extends WebSecurityConfigurerAdapter {
 
@@ -205,6 +208,7 @@ protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 
 	}
 
+	@Configuration
 	@EnableWebSecurity
 	static class DefaultsInLambdaConfig extends WebSecurityConfigurerAdapter {
 
@@ -227,6 +231,7 @@ protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 
 	}
 
+	@Configuration
 	@EnableWebSecurity
 	static class SubjectPrincipalRegexInLambdaConfig extends WebSecurityConfigurerAdapter {
 
@@ -252,6 +257,7 @@ protected void configure(AuthenticationManagerBuilder auth) throws Exception {
 
 	}
 
+	@Configuration
 	@EnableWebSecurity
 	static class UserDetailsServiceBeanConfig {
 
@@ -279,6 +285,7 @@ UserDetailsService userDetailsService() {
 
 	}
 
+	@Configuration
 	@EnableWebSecurity
 	static class UserDetailsServiceAndBeanConfig {
 
diff --git a/config/src/test/kotlin/org/springframework/security/config/annotation/method/configuration/KotlinEnableReactiveMethodSecurityTests.kt b/config/src/test/kotlin/org/springframework/security/config/annotation/method/configuration/KotlinEnableReactiveMethodSecurityTests.kt
@@ -210,8 +210,8 @@ class KotlinEnableReactiveMethodSecurityTests {
         verify { delegate wasNot Called }
     }
 
-    @EnableReactiveMethodSecurity
     @Configuration
+    @EnableReactiveMethodSecurity
     open class Config {
         var delegate = mockk<KotlinReactiveMessageService>()
 
diff --git a/config/src/test/kotlin/org/springframework/security/config/web/server/AuthorizeExchangeDslTests.kt b/config/src/test/kotlin/org/springframework/security/config/web/server/AuthorizeExchangeDslTests.kt
@@ -32,7 +32,7 @@ import org.springframework.test.web.reactive.server.WebTestClient
 import org.springframework.web.bind.annotation.RequestMapping
 import org.springframework.web.bind.annotation.RestController
 import org.springframework.web.reactive.config.EnableWebFlux
-import java.util.*
+import java.util.Base64
 
 /**
  * Tests for [AuthorizeExchangeDsl]
diff --git a/docs/modules/ROOT/pages/servlet/authorization/method-security.adoc b/docs/modules/ROOT/pages/servlet/authorization/method-security.adoc
@@ -1,3 +1,4 @@
+
 [[jc-method]]
 = Method Security
 
@@ -32,6 +33,7 @@ For example, the following would enable Spring Security's `@PreAuthorize` annota
 .Java
 [source,java,role="primary"]
 ----
+@Configuration
 @EnableMethodSecurity
 public class MethodSecurityConfig {
 	// ...
@@ -41,6 +43,7 @@ public class MethodSecurityConfig {
 .Kotlin
 [source,kotlin,role="secondary"]
 ----
+@Configuration
 @EnableMethodSecurity
 class MethodSecurityConfig {
 	// ...
@@ -98,6 +101,7 @@ You can enable support for Spring Security's `@Secured` annotation using:
 .Java
 [source,java,role="primary"]
 ----
+@Configuration
 @EnableMethodSecurity(securedEnabled = true)
 public class MethodSecurityConfig {
 	// ...
@@ -107,6 +111,7 @@ public class MethodSecurityConfig {
 .Kotlin
 [source,kotlin,role="secondary"]
 ----
+@Configuration
 @EnableMethodSecurity(securedEnabled = true)
 class MethodSecurityConfig {
 	// ...
@@ -127,6 +132,7 @@ or JSR-250 using:
 .Java
 [source,java,role="primary"]
 ----
+@Configuration
 @EnableMethodSecurity(jsr250Enabled = true)
 public class MethodSecurityConfig {
 	// ...
@@ -136,6 +142,7 @@ public class MethodSecurityConfig {
 .Kotlin
 [source,kotlin,role="secondary"]
 ----
+@Configuration
 @EnableMethodSecurity(jsr250Enabled = true)
 class MethodSecurityConfig {
 	// ...
@@ -264,6 +271,7 @@ To recreate what adding `@EnableMethodSecurity` does by default, you would publi
 .Java
 [source,java,role="primary"]
 ----
+@Configuration
 @EnableMethodSecurity(prePostEnabled = false)
 class MethodSecurityConfig {
 	@Bean
@@ -295,6 +303,7 @@ class MethodSecurityConfig {
 .Kotlin
 [source,kotlin,role="secondary"]
 ----
+@Configuration
 @EnableMethodSecurity(prePostEnabled = false)
 class MethodSecurityConfig {
 	@Bean
@@ -392,6 +401,7 @@ You may want to only support `@PreAuthorize` in your application, in which case
 .Java
 [source,java,role="primary"]
 ----
+@Configuration
 @EnableMethodSecurity(prePostEnabled = false)
 class MethodSecurityConfig {
 	@Bean
@@ -405,6 +415,7 @@ class MethodSecurityConfig {
 .Kotlin
 [source,kotlin,role="secondary"]
 ----
+@Configuration
 @EnableMethodSecurity(prePostEnabled = false)
 class MethodSecurityConfig {
 	@Bean
@@ -440,6 +451,7 @@ Thus, you can configure Spring Security to invoke your `AuthorizationManager` in
 .Java
 [source,java,role="primary"]
 ----
+@Configuration
 @EnableMethodSecurity
 class MethodSecurityConfig {
 	@Bean
@@ -458,6 +470,7 @@ class MethodSecurityConfig {
 .Kotlin
 [source,kotlin,role="secondary"]
 ----
+@Configuration
 @EnableMethodSecurity
 class MethodSecurityConfig {
 	@Bean
@@ -542,6 +555,7 @@ For example, if you have your own custom annotation, you can configure it like s
 .Java
 [source,java,role="primary"]
 ----
+@Configuration
 @EnableMethodSecurity
 class MethodSecurityConfig {
 	@Bean
@@ -558,6 +572,7 @@ class MethodSecurityConfig {
 .Kotlin
 [source,kotlin,role="secondary"]
 ----
+@Configuration
 @EnableMethodSecurity
 class MethodSecurityConfig {
 	@Bean
@@ -607,6 +622,7 @@ The following example enables Spring Security's `@Secured` annotation:
 .Java
 [source,java,role="primary"]
 ----
+@Configuration
 @EnableGlobalMethodSecurity(securedEnabled = true)
 public class MethodSecurityConfig {
 // ...
@@ -616,6 +632,7 @@ public class MethodSecurityConfig {
 .Kotlin
 [source,kotlin,role="secondary"]
 ----
+@Configuration
 @EnableGlobalMethodSecurity(securedEnabled = true)
 open class MethodSecurityConfig {
 	// ...
@@ -666,6 +683,7 @@ Support for JSR-250 annotations can be enabled by using:
 .Java
 [source,java,role="primary"]
 ----
+@Configuration
 @EnableGlobalMethodSecurity(jsr250Enabled = true)
 public class MethodSecurityConfig {
 // ...
@@ -675,6 +693,7 @@ public class MethodSecurityConfig {
 .Kotlin
 [source,kotlin,role="secondary"]
 ----
+@Configuration
 @EnableGlobalMethodSecurity(jsr250Enabled = true)
 open class MethodSecurityConfig {
 	// ...
@@ -689,6 +708,7 @@ To use the new expression-based syntax, you would use:
 .Java
 [source,java,role="primary"]
 ----
+@Configuration
 @EnableGlobalMethodSecurity(prePostEnabled = true)
 public class MethodSecurityConfig {
 // ...
@@ -698,6 +718,7 @@ public class MethodSecurityConfig {
 .Kotlin
 [source,kotlin,role="secondary"]
 ----
+@Configuration
 @EnableGlobalMethodSecurity(prePostEnabled = true)
 open class MethodSecurityConfig {
 	// ...
@@ -750,6 +771,7 @@ For example, if you wanted to provide a custom `MethodSecurityExpressionHandler`
 .Java
 [source,java,role="primary"]
 ----
+@Configuration
 @EnableGlobalMethodSecurity(prePostEnabled = true)
 public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
 	@Override
@@ -763,6 +785,7 @@ public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {
 .Kotlin
 [source,kotlin,role="secondary"]
 ----
+@Configuration
 @EnableGlobalMethodSecurity(prePostEnabled = true)
 open class MethodSecurityConfig : GlobalMethodSecurityConfiguration() {
     override fun createExpressionHandler(): MethodSecurityExpressionHandler {
diff --git a/docs/modules/ROOT/pages/servlet/configuration/java.adoc b/docs/modules/ROOT/pages/servlet/configuration/java.adoc
@@ -324,6 +324,7 @@ You can also explicit disable the default:
 ====
 [source,java]
 ----
+@Configuration
 @EnableWebSecurity
 public class Config {
 	@Bean
diff --git a/docs/modules/ROOT/pages/servlet/exploits/headers.adoc b/docs/modules/ROOT/pages/servlet/exploits/headers.adoc
diff --git a/docs/modules/ROOT/pages/servlet/oauth2/login/advanced.adoc b/docs/modules/ROOT/pages/servlet/oauth2/login/advanced.adoc
diff --git a/docs/modules/ROOT/pages/servlet/oauth2/resource-server/jwt.adoc b/docs/modules/ROOT/pages/servlet/oauth2/resource-server/jwt.adoc

Original file line number	Diff line number	Diff line change
`@@ -189,6 +189,7 @@ protected void configure(AuthenticationManagerBuilder auth) throws Exception {`
`189`	`189`
`190`	`190`	`}`
`191`	`191`
	`192`	`+ @Configuration`
`192`	`193`	`@EnableWebSecurity`
`193`	`194`	`static class GroupSearchConfig extends BaseLdapProviderConfig {`
`194`	`195`
Original file line number	Diff line number	Diff line change
`@@ -531,8 +531,8 @@ Authz authz() {`
`531`	`531`
`532`	`532`	`}`
`533`	`533`
`534`		`- @EnableGlobalMethodSecurity(prePostEnabled = true)`
`535`	`534`	`@Configuration`
	`535`	`+ @EnableGlobalMethodSecurity(prePostEnabled = true)`
`536`	`536`	`public static class RoleHierarchyConfig {`
`537`	`537`
`538`	`538`	`@Bean`
`@@ -607,8 +607,8 @@ void emptyPrefixRoleUser() {`
`607`	`607`
`608`	`608`	`}`
`609`	`609`
`610`		`- @EnableGlobalMethodSecurity(prePostEnabled = true)`
`611`	`610`	`@Configuration`
	`611`	`+ @EnableGlobalMethodSecurity(prePostEnabled = true)`
`612`	`612`	`public static class CustomMetadataSourceBeanProxyEnabledConfig extends GlobalMethodSecurityConfiguration {`
`613`	`613`
`614`	`614`	`}`
Original file line number	Diff line number	Diff line change
`@@ -316,8 +316,8 @@ protected AuthenticationManager authenticationManager() {`
`316`	`316`
`317`	`317`	`}`
`318`	`318`
`319`		`- @EnableGlobalMethodSecurity(jsr250Enabled = true)`
`320`	`319`	`@Configuration`
	`320`	`+ @EnableGlobalMethodSecurity(jsr250Enabled = true)`
`321`	`321`	`public static class Jsr250Config {`
`322`	`322`
`323`	`323`	`}`
Original file line number	Diff line number	Diff line change
`@@ -127,6 +127,7 @@ protected void configure(HttpSecurity http) throws Exception {`
`127`	`127`
`128`	`128`	`}`
`129`	`129`
	`130`	`+ @Configuration`
`130`	`131`	`@EnableWebSecurity`
`131`	`132`	`static class AnonymousDisabledInLambdaConfig extends WebSecurityConfigurerAdapter {`
`132`	`133`
Original file line number	Diff line number	Diff line change
`@@ -131,6 +131,7 @@ protected void configure(HttpSecurity http) throws Exception {`
`131`	`131`
`132`	`132`	`}`
`133`	`133`
	`134`	`+ @Configuration`
`134`	`135`	`@EnableWebSecurity`
`135`	`136`	`static class FormLoginCustomConfig extends WebSecurityConfigurerAdapter {`
`136`	`137`
Original file line number	Diff line number	Diff line change
`@@ -26,6 +26,7 @@`
`26`	`26`
`27`	`27`	`import org.springframework.beans.factory.annotation.Autowired;`
`28`	`28`	`import org.springframework.context.annotation.Bean;`
	`29`	`+import org.springframework.context.annotation.Configuration;`
`29`	`30`	`import org.springframework.core.io.ClassPathResource;`
`30`	`31`	`import org.springframework.security.config.annotation.ObjectPostProcessor;`
`31`	`32`	`import org.springframework.security.config.annotation.SecurityContextChangedListenerConfig;`
`@@ -151,6 +152,7 @@ private <T extends Certificate> T loadCert(String location) {`
`151`	`152`	`}`
`152`	`153`	`}`
`153`	`154`
	`155`	`+ @Configuration`
`154`	`156`	`@EnableWebSecurity`
`155`	`157`	`static class ObjectPostProcessorConfig extends WebSecurityConfigurerAdapter {`
`156`	`158`
`@@ -180,6 +182,7 @@ public <O> O postProcess(O object) {`
`180`	`182`
`181`	`183`	`}`
`182`	`184`
	`185`	`+ @Configuration`
`183`	`186`	`@EnableWebSecurity`
`184`	`187`	`static class DuplicateDoesNotOverrideConfig extends WebSecurityConfigurerAdapter {`
`185`	`188`
`@@ -205,6 +208,7 @@ protected void configure(AuthenticationManagerBuilder auth) throws Exception {`
`205`	`208`
`206`	`209`	`}`
`207`	`210`
	`211`	`+ @Configuration`
`208`	`212`	`@EnableWebSecurity`
`209`	`213`	`static class DefaultsInLambdaConfig extends WebSecurityConfigurerAdapter {`
`210`	`214`
`@@ -227,6 +231,7 @@ protected void configure(AuthenticationManagerBuilder auth) throws Exception {`
`227`	`231`
`228`	`232`	`}`
`229`	`233`
	`234`	`+ @Configuration`
`230`	`235`	`@EnableWebSecurity`
`231`	`236`	`static class SubjectPrincipalRegexInLambdaConfig extends WebSecurityConfigurerAdapter {`
`232`	`237`
`@@ -252,6 +257,7 @@ protected void configure(AuthenticationManagerBuilder auth) throws Exception {`
`252`	`257`
`253`	`258`	`}`
`254`	`259`
	`260`	`+ @Configuration`
`255`	`261`	`@EnableWebSecurity`
`256`	`262`	`static class UserDetailsServiceBeanConfig {`
`257`	`263`
`@@ -279,6 +285,7 @@ UserDetailsService userDetailsService() {`
`279`	`285`
`280`	`286`	`}`
`281`	`287`
	`288`	`+ @Configuration`
`282`	`289`	`@EnableWebSecurity`
`283`	`290`	`static class UserDetailsServiceAndBeanConfig {`
`284`	`291`
Original file line number	Diff line number	Diff line change
`@@ -210,8 +210,8 @@ class KotlinEnableReactiveMethodSecurityTests {`
`210`	`210`	`verify { delegate wasNot Called }`
`211`	`211`	`}`
`212`	`212`
`213`		`- @EnableReactiveMethodSecurity`
`214`	`213`	`@Configuration`
	`214`	`+ @EnableReactiveMethodSecurity`
`215`	`215`	`open class Config {`
`216`	`216`	`var delegate = mockk<KotlinReactiveMessageService>()`
`217`	`217`