WebSecurityConfigurerAdapter to SecurityFilterChain Migration (Spring Security 6)
Fast recall
Quick revision
Core answer
HttpSecurity and returns http.build(). Replace `configure(AuthenticationManagerBuilder)` with a `UserDetailsService` + `PasswordEncoder` bean (and optionally a DaoAuthenticationProvider/AuthenticationManager bean). Replace `configure(WebSecurity)` ignore lists with WebSecurityCustomizer. Switch `antMatchers` -> `requestMatchers`, `authorizeRequests` -> `authorizeHttpRequests`, `@EnableGlobalMethodSecurity` -> `@EnableMethodSecurity`, and remove all `.and()` chaining in favor of the lambda DSL.Hands-on knowledge of the Spring Security 5.7 -> 6 migration that every Boot 3 upgrade hits.
Leaving `WebSecurityConfigurerAdapter` in code, mixing `.and()` with lambda DSL, or losing CSRF/role-prefix nuances during the rewrite.
Discuss the `AuthorizationFilter` replacing `FilterSecurityInterceptor`, the new `authorizeHttpRequests` model, and `WebSecurityCustomizer` as the replacement for `configure(WebSecurity)`.
Interview-ready guide
Interview answer
The structural change
WebSecurityConfigurerAdapterremoved in 6.0- Replace inheritance with
@Beandeclarations:SecurityFilterChain,UserDetailsService,PasswordEncoder,AuthenticationManager configure(WebSecurity)->WebSecurityCustomizerbean
DSL changes
antMatchers->requestMatchersauthorizeRequests->authorizeHttpRequests- Remove
.and()chaining; each method takes a lambda Customizer .csrf().disable()->.csrf(AbstractHttpConfigurer::disable)
Annotation changes
@EnableGlobalMethodSecurity(prePostEnabled = true)->@EnableMethodSecurity(prePost on by default)securedEnabled/jsr250Enabledstill explicit
AuthenticationManager
- No more
authenticationManagerBean() - Declare
@Bean AuthenticationManagerwithDaoAuthenticationProvider+ProviderManager
Internal change
AuthorizationFilterreplacesFilterSecurityInterceptor- New
AuthorizationManagerAPI — composable, extensible
Watch for
- Mixing
.and()with lambda DSL -> compile errors - Forgetting
@EnableMethodSecurity->@PreAuthorizeignored hasRole("ADMIN")still requiresROLE_ADMINauthority prefixWebSecurityCustomizeronly for static resources — never for API paths- CSRF token handler change:
XorCsrfTokenRequestAttributeHandlermay break SPAs that expect plain tokens
WebSecurityConfigurerAdapter to SecurityFilterChain Migration (Spring Security 6)
Direct Answer
Spring Security 6 removed WebSecurityConfigurerAdapter. Migrate by replacing the adapter subclass with a SecurityFilterChain bean that takes HttpSecurity and returns http.build(). Replace configure(AuthenticationManagerBuilder) with a UserDetailsService + PasswordEncoder bean (and optionally a DaoAuthenticationProvider/AuthenticationManager bean). Replace configure(WebSecurity) ignore lists with WebSecurityCustomizer. Switch antMatchers -> requestMatchers, authorizeRequests -> authorizeHttpRequests, @EnableGlobalMethodSecurity -> @EnableMethodSecurity, and remove all .and() chaining in favor of the lambda DSL.
Common Mistakes & Pitfalls
Leaving WebSecurityConfigurerAdapter in code, mixing .and() with lambda DSL, or losing CSRF/role-prefix nuances during the rewrite.
Check your understanding
Answer these without looking back at the article.
- Why was WebSecurityConfigurerAdapter removed?
- What is the difference between WebSecurityCustomizer and an authorizeHttpRequests permitAll?
- How does AuthorizationFilter differ from FilterSecurityInterceptor?
- What CSRF token handler change in Spring Security 6 can break SPAs?
Related interview prep categories
2Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.