Customizer is a Spring Security functional interface whose callback applies configuration to a framework configuration object. HttpSecurity accepts it for authentication, authorization, CSRF, CORS, and other protection mechanisms. section 2.3.2
Because Customizer is functional, Java lambda expressions can implement it. Customizer.withDefaults() returns an implementation whose callback does nothing, preserving the selected feature’s defaults. section 2.3.2
Use a Customizer to configure a specific Spring Security feature:
- Configure HTTP Basic authentication with httpBasic(Customizer.withDefaults()) or customize its realm name and authentication entry point. section 6.3.1
- Configure endpoint authorization with authorizeHttpRequests(), selecting rules such as authenticated() or permitAll(). section 2.3.2
- Configure CSRF protection with csrf(), including ignored paths, RequestMatcher objects, token repositories, and request handlers. section 9.3
Customizing HTTP Basic
A SecurityFilterChain can set a different HTTP Basic realm and replace the authentication failure handler: http.httpBasic(c -> { c.realmName("OTHER"); c.authenticationEntryPoint(new CustomEntryPoint()); }); The entry point can add a response header and return HTTP 401. section 6.3.1
@FunctionalInterface
public interface Customizer<T> {
void customize(T t);
static <T> Customizer<T> withDefaults() {
return (t) -> {
};
}
}
Inspect the interface definition and its no-op withDefaults() implementation. section 2.3.2
Compared with older chaining syntax, Customizer callbacks make growing configurations easier to move into separate classes, improving maintainability and testability. section 2.3.2
