You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
return new Class[] { WebSecurityConfig.class, WebMvcConfig.class };
126
126
}
127
127
128
128
// ... other overrides ...
129
129
}
130
130
----
131
131
132
+
The reason for this is that Spring Security needs to be able to inspect some Spring MVC configuration in order to appropriately configure xref:servlet/authorization/authorize-http-requests.adoc#_request_matchers[underlying request matchers], so they need to be in the same application context.
133
+
Placing Spring Security in `getRootConfigClasses` places it into a parent application context that may not be able to find Spring MVC's `HandlerMappingIntrospector`.
134
+
135
+
==== Configuring for Multiple Spring MVC Dispatchers
136
+
137
+
If desired, any Spring Security configuration that is unrelated to Spring MVC may be placed in a different configuration class like so:
return new Class[] { NonWebSecurityConfig.class };
147
+
}
148
+
149
+
@Override
150
+
protected Class<?>[] getServletConfigClasses() {
151
+
return new Class[] { WebSecurityConfig.class, WebMvcConfig.class };
152
+
}
153
+
154
+
// ... other overrides ...
155
+
}
156
+
----
157
+
158
+
This can be helpful if you have multiple instances of `AbstractAnnotationConfigDispatcherServletInitializer` and don't want to duplicate the general security configuration across both of them.
0 commit comments