Spring Security

I have written about integrating Spring Security with Spring MVC earlier – https://javashine.wordpress.com/tag/spring-security/

Here is another step by step by instructions. This blog post assumes you already have a Spring MVC working in your workspace. This one uses annotation based configurations.

I have a simple test web application with two URLs.

/ (root URL)


While I’ll leave my / url unprotected, I want to secure /add_expense. Here is how we do it.

Adding Spring Security to Spring4 MVC

This is my project structure.


I wrote very simple MVC controller and it is working.

Add the following to Maven project dependencies.

<!-- Security -->

Under properties I’ve added this.



Following is the controller I’m going to secure. I’ll leave / open and protect /add_expense


Define a Spring security configuration. I have only one user admin.

package org.grassfield.gaja;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

public class SecurityConfig extends WebSecurityConfigurerAdapter {

public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {

protected void configure(HttpSecurity http) throws Exception {

Initialize security filter chain.

package org.grassfield.gaja;

import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;

public class SpringSecurityInitializer extends
AbstractSecurityWebApplicationInitializer {


Load the spring security to Spring MVC Application config. Check the highlighted path.



And finally load everything

package org.grassfield.gaja;

import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer;

public class SpringMvcInitializer extends
AbstractAnnotationConfigDispatcherServletInitializer {

protected Class<?>[] getRootConfigClasses() {
return new Class[] { ApplicationContextConfig.class };

protected Class<?>[] getServletConfigClasses() {
return null;

protected String[] getServletMappings() {
return new String[] { "/" };







Way to go!

And, finally, here is the pic of the day.

CYmwbxbUQAAWCGH.jpg large
Learning something is a time machine that can bring you back to your school days!

Happy Pongal.
Happy Sankaranti.Happy Utarayan.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s