Deprecated List (spring-security-config 5.8.2 API)

Classes
Class	Description
org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration	Use `PrePostMethodSecurityConfiguration`, `SecuredMethodSecurityConfiguration`, or `Jsr250MethodSecurityConfiguration` instead
org.springframework.security.config.annotation.web.builders.WebSecurity.MvcMatchersIgnoredRequestConfigurer	use `MvcRequestMatcher.Builder` instead
org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter	Use a `SecurityFilterChain` Bean to configure `HttpSecurity` or a `WebSecurityCustomizer` Bean to configure `WebSecurity`. @Bean public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { http .authorizeHttpRequests((authz) -> authz.anyRequest().authenticated() ); // ... return http.build(); } @Bean public WebSecurityCustomizer webSecurityCustomizer(WebSecurity web) { return (web) -> web.ignoring().antMatchers("/resources/**"); } See the Spring Security without WebSecurityConfigurerAdapter for more details.
org.springframework.security.config.annotation.web.configurers.AbstractInterceptUrlConfigurer	Use `AuthorizeHttpRequestsConfigurer` instead
org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer.MvcMatchersAuthorizedUrl	use `MvcRequestMatcher.Builder` instead
org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer	Use `AuthorizeHttpRequestsConfigurer` instead
org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.HpkpConfig	see Certificate and Public Key Pinning for more context
org.springframework.security.config.annotation.web.configurers.oauth2.client.ImplicitGrantConfigurer	It is not recommended to use the implicit flow due to the inherent risks of returning access tokens in an HTTP redirect without any confirmation that it has been received by the client. See reference OAuth 2.0 Implicit Grant.
org.springframework.security.config.annotation.web.configurers.openid.OpenIDLoginConfigurer	The OpenID 1.0 and 2.0 protocols have been deprecated and users are encouraged to migrate to OpenID Connect, which is supported by `spring-security-oauth2`.
org.springframework.security.config.annotation.web.configurers.UrlAuthorizationConfigurer	Use `AuthorizeHttpRequestsConfigurer` instead
org.springframework.security.config.annotation.web.messaging.MessageSecurityMetadataSourceRegistry	Use `MessageMatcherDelegatingAuthorizationManager` instead
org.springframework.security.config.annotation.web.servlet.configuration.WebMvcSecurityConfiguration	This is applied internally using SpringWebMvcImportSelector
org.springframework.security.config.annotation.web.socket.AbstractSecurityWebSocketMessageBrokerConfigurer	Use `EnableWebSocketSecurity` instead
org.springframework.security.config.http.FilterInvocationSecurityMetadataSourceParser	Use `use-authorization-manager` property instead
org.springframework.security.config.method.GlobalMethodSecurityBeanDefinitionParser	Use `MethodSecurityBeanDefinitionParser` instead
org.springframework.security.config.method.MethodSecurityMetadataSourceBeanDefinitionParser	Use `<intercept-methods>`, `<method-security>`, or `@EnableMethodSecurity`

Annotation Types
Annotation Type	Description
org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity	Use `EnableMethodSecurity` instead
org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity	Use EnableWebSecurity instead which will automatically add the Spring MVC related Security items.

Methods
Method	Description
org.springframework.security.config.annotation.rsocket.RSocketSecurity.basicAuthentication(Customizer<RSocketSecurity.BasicAuthenticationSpec>)	Use `RSocketSecurity.simpleAuthentication(Customizer)`
org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry.antMatchers(HttpMethod)	use `AbstractRequestMatcherRegistry.requestMatchers(HttpMethod)` instead
org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry.mvcMatchers(String...)	use `AbstractRequestMatcherRegistry.requestMatchers(String...)` instead
org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry.regexMatchers(HttpMethod, String...)	use `AbstractRequestMatcherRegistry.requestMatchers(RequestMatcher...)` with a `RegexRequestMatcher` instead
org.springframework.security.config.annotation.web.builders.HttpSecurity.antMatcher(String)	use `HttpSecurity.securityMatcher(String...)` instead
org.springframework.security.config.annotation.web.builders.HttpSecurity.authorizeRequests()	Use `HttpSecurity.authorizeHttpRequests()` instead
org.springframework.security.config.annotation.web.builders.HttpSecurity.mvcMatcher(String)	use `HttpSecurity.securityMatcher(String...)` instead
org.springframework.security.config.annotation.web.builders.HttpSecurity.openidLogin()	The OpenID 1.0 and 2.0 protocols have been deprecated and users are encouraged to migrate to OpenID Connect, which is supported by `spring-security-oauth2`.
org.springframework.security.config.annotation.web.builders.HttpSecurity.regexMatcher(String)	use `HttpSecurity.securityMatcher(RequestMatcher)` with a `RegexRequestMatcher` instead
org.springframework.security.config.annotation.web.builders.HttpSecurity.requestMatcher(RequestMatcher)	use `HttpSecurity.securityMatcher(RequestMatcher)` instead
org.springframework.security.config.annotation.web.builders.HttpSecurity.RequestMatcherConfigurer.mvcMatchers(HttpMethod, String...)	use `AbstractRequestMatcherRegistry.requestMatchers(HttpMethod, String...)` instead
org.springframework.security.config.annotation.web.builders.HttpSecurity.requestMatchers()	use `HttpSecurity.securityMatchers()` instead
org.springframework.security.config.annotation.web.builders.WebSecurity.IgnoredRequestConfigurer.mvcMatchers(HttpMethod, String...)	use `AbstractRequestMatcherRegistry.requestMatchers(HttpMethod, String...)` instead
org.springframework.security.config.annotation.web.builders.WebSecurity.securityInterceptor(FilterSecurityInterceptor)	Use `WebSecurity.privilegeEvaluator(WebInvocationPrivilegeEvaluator)` instead
org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequestMatcherRegistry.mvcMatchers(String...)	use `AbstractRequestMatcherRegistry.requestMatchers(String...)` instead
org.springframework.security.config.annotation.web.configurers.ChannelSecurityConfigurer.ChannelRequestMatcherRegistry.mvcMatchers(HttpMethod, String...)	use `AbstractRequestMatcherRegistry.requestMatchers(HttpMethod, String...)` instead
org.springframework.security.config.annotation.web.configurers.CsrfConfigurer.ignoringAntMatchers(String...)	use `CsrfConfigurer.ignoringRequestMatchers(RequestMatcher...)` with an `AntPathRequestMatcher` instead
org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrlRegistry.mvcMatchers(HttpMethod, String...)	use `AbstractRequestMatcherRegistry.requestMatchers(HttpMethod, String...)` instead
org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.featurePolicy(String)	Use `HeadersConfigurer.permissionsPolicy(Customizer)` instead.
org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.httpPublicKeyPinning()	see Certificate and Public Key Pinning for more context
org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.XXssConfig.block(boolean)	use `HeadersConfigurer.XXssConfig.headerValue(XXssProtectionHeaderWriter.HeaderValue)` instead
org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.XXssConfig.xssProtectionEnabled(boolean)	use `HeadersConfigurer.XXssConfig.headerValue(XXssProtectionHeaderWriter.HeaderValue)` instead
org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer.UserInfoEndpointConfig.customUserType(Class<? extends OAuth2User>, String)	See `CustomUserTypesOAuth2UserService` for alternative usage.
org.springframework.security.config.annotation.web.configurers.UrlAuthorizationConfigurer.StandardInterceptUrlRegistry.mvcMatchers(HttpMethod, String...)	use `AbstractRequestMatcherRegistry.requestMatchers(HttpMethod, String...)` instead
org.springframework.security.config.annotation.web.socket.AbstractSecurityWebSocketMessageBrokerConfigurer.setMessageExpessionHandler(List<SecurityExpressionHandler<Message<Object>>>)
org.springframework.security.config.web.server.ServerHttpSecurity.CsrfSpec.tokenFromMultipartDataEnabled(boolean)	Use `ServerCsrfTokenRequestAttributeHandler.setTokenFromMultipartDataEnabled(boolean)` instead
org.springframework.security.config.web.server.ServerHttpSecurity.HeaderSpec.featurePolicy(String)	Use `ServerHttpSecurity.HeaderSpec.permissionsPolicy(Customizer)` instead.

Deprecated API

Contents