Skip to content

Commit c336ca4

Browse files
committed
Update Spring MVC Docs
Closes gh-14220
1 parent c623303 commit c336ca4

File tree

1 file changed

+31
-3
lines changed
  • docs/modules/ROOT/pages/servlet/configuration

1 file changed

+31
-3
lines changed

docs/modules/ROOT/pages/servlet/configuration/java.adoc

Lines changed: 31 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@ public class SecurityWebApplicationInitializer
112112

113113
This would simply only register the springSecurityFilterChain Filter for every URL in your application.
114114
After that we would ensure that `WebSecurityConfig` was loaded in our existing ApplicationInitializer.
115-
For example, if we were using Spring MVC it would be added in the `getRootConfigClasses()`
115+
For example, if we were using Spring MVC it would be added in the `getServletConfigClasses()`
116116

117117
[[message-web-application-inititializer-java]]
118118
[source,java]
@@ -121,14 +121,42 @@ public class MvcWebApplicationInitializer extends
121121
AbstractAnnotationConfigDispatcherServletInitializer {
122122
123123
@Override
124-
protected Class<?>[] getRootConfigClasses() {
125-
return new Class[] { WebSecurityConfig.class };
124+
protected Class<?>[] getServletConfigClasses() {
125+
return new Class[] { WebSecurityConfig.class, WebMvcConfig.class };
126126
}
127127
128128
// ... other overrides ...
129129
}
130130
----
131131

132+
The reason for this is that Spring Security needs to be able to inspect some Spring MVC configuration in order to appropriately configure xref:servlet/authorization/authorize-http-requests.adoc#_request_matchers[underlying request matchers], so they need to be in the same application context.
133+
Placing Spring Security in `getRootConfigClasses` places it into a parent application context that may not be able to find Spring MVC's `HandlerMappingIntrospector`.
134+
135+
==== Configuring for Multiple Spring MVC Dispatchers
136+
137+
If desired, any Spring Security configuration that is unrelated to Spring MVC may be placed in a different configuration class like so:
138+
139+
[source,java]
140+
----
141+
public class MvcWebApplicationInitializer extends
142+
AbstractAnnotationConfigDispatcherServletInitializer {
143+
144+
@Override
145+
protected Class<?>[] getRootConfigClasses() {
146+
return new Class[] { NonWebSecurityConfig.class };
147+
}
148+
149+
@Override
150+
protected Class<?>[] getServletConfigClasses() {
151+
return new Class[] { WebSecurityConfig.class, WebMvcConfig.class };
152+
}
153+
154+
// ... other overrides ...
155+
}
156+
----
157+
158+
This can be helpful if you have multiple instances of `AbstractAnnotationConfigDispatcherServletInitializer` and don't want to duplicate the general security configuration across both of them.
159+
132160
[[jc-httpsecurity]]
133161
== HttpSecurity
134162

0 commit comments

Comments
 (0)