HttpSecurity is the configuration API used inside a SecurityFilterChain bean to customize servlet-based authentication, endpoint authorization, and protection mechanisms. Spring Security applies HTTP Basic authentication by default; explicit HttpSecurity configuration replaces or preserves those defaults. section 2.3.2
Configure the security behavior by chaining focused methods:
- Call httpBasic(Customizer.withDefaults()) to accept HTTP Basic authentication. section 2.3.2
- Call authorizeHttpRequests() to define endpoint authorization, such as anyRequest().authenticated() or anyRequest().permitAll(). section 2.3.2
- Register a local UserDetailsService with userDetailsService() when user details do not need to be exposed as another Spring bean. section 2.3.3
- Customize CSRF protection with csrf(), including excluded paths, RequestMatcher implementations, token repositories, and request handlers. section 9.3
Permit every endpoint
A SecurityFilterChain method can configure HTTP Basic while allowing every request: http.httpBasic(Customizer.withDefaults()); http.authorizeHttpRequests(c -> c.anyRequest().permitAll()); return http.build(); section 2.3.2
Listing 2.7 Using the HttpSecurity parameter to alter the configuration
@Configuration
public class ProjectConfig {
@Bean
SecurityFilterChain configure(HttpSecurity http)
throws Exception {
http.httpBasic(Customizer.withDefaults()); #1
http.authorizeHttpRequests(
c -> c.anyRequest().authenticated() #2
);
return http.build();
}
// Omitted code
}
Inspect the complete SecurityFilterChain example showing HTTP Basic and authenticated endpoint authorization. section 2.3.2
