There are lots of ways to configure spring security, xml, java config classic, java config lambdas, boot auto configuration. The internet is full of blog posts, stackoveflow questions, on how to configure spring security to do x, or y. Many of these posts are out of date, it is super confusing to know if you are doing things right. Given that a misconfiguration of spring security in an application can be devastating for the business running the application. I recommend adding an authoritative chapter on configuring security to the introduction part of the docs. Below is a proposed outline of the chapter.

  • Overview section that provides a summary of the all the different options for configuring spring. For each configuration approach provide and 1 paragraph description of the approach, it's historical evolution, which version of spring security it was introduced in. Will be supported into the future.
  • Recommenced approach A section that provides clear guidance on what approach is recommend as of that version of the spring security, for different situations, boot vs. not boot ... etc.
  • Java Config DSL Overview A section that provides an overview of the Java configuration DSL, how it works, how to format the code when working with it ... etc. This is the big picture that a user needs to know to understand the rest of the docs.
  • Kotlin Support a section that explains how kotlin supports work.
  • XML Config Overview A section that provides an overview of the XML config. This is the big picture that a user needs to know to understand the rest of the docs.
  • migrating from xml to java config A section that provides hints on how to migrate from xml to javaconfig

Comment From: rwinch

I like the suggestion. A few things to talk about though:

  • I don't think we will give a Recommended approach short of saying use Spring Boot. Spring tends to stay out of opinions
  • I'd like this introductory section to be a follow up to the Hello Security section. We'd need Hello Security samples for each type of configuration we want.
  • We would also want to discuss how bootstrapping the configuration works. In an XML world this is done via web.xml and ContextLoaderListener. In Boot, it picks up configuraiton via classpath scanning.