Confusing example - WebMvcConfigurer vs WebSecurityConfigurerAdapter

[adamzimny]

Summary

In Spring Security documentation in the hello-web example here:
https://docs.spring.io/spring-security/site/docs/5.1.5.RELEASE/reference/htmlsingle/#hello-web-security-java-configuration
the code is:

@EnableWebSecurity
public class WebSecurityConfig implements WebMvcConfigurer {

This suggests that custom implementation of WebMvcConfigurer interface is the standard way of Spring Security configuration.

Further down in the documentation usage of WebSecurityConfigurerAdapter is mentioned and multiple examples of void configure(HttpSecurity http) customization are given.

This raises confusion about the role of WebMvcConfigurer in Spring Security and the use cases for WebMvcConfigurer vs WebSecurityConfigurerAdapter.

Most likely the intention in the example was:

@EnableWebSecurity
public class WebSecurityConfig implements WebSecurityConfigurerAdapter {

instead of

@EnableWebSecurity
public class WebSecurityConfig implements WebMvcConfigurer {

Version

5.1.5

Sample

Not only I got confused, Stackoverflow discussing the same:
https://stackoverflow.com/questions/53894649/difference-between-webmvcconfigurer-and-websecurityconfigureradapter

[jzheaux]

@adamzimny I agree with your analysis, thanks for the report. Would you be able to submit a PR with the needed change?

[pthorson]

Can same be checked in for 5.1.x branch? Thank you.

[jzheaux]

Actually, I'm thinking that it's not quite as simple as switching out the class reference.

The issue here is that the documentation states:

You can find the most basic example of a Spring Security Java Configuration below:

And if we add the extends WebSecurityConfigurerAdapter, then that's actually a false statement as the simplest configuration requires no extends at all. I had originally missed this when I recommended this for a PR.

I agree with @rwinch here that the best fix would be to remove the implements WebMvcConfigurer and update the way WebSecurityConfigurerAdapter is introduced in the documentation. This could likely be done by changing only a couple of sentences.