# All Classes and Interfaces

Class
Description
AbstractAuthenticationFilterConfigurer<B extends HttpSecurityBuilder<B>,T extends AbstractAuthenticationFilterConfigurer<B,T,F>,F extends org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter>
Base class for configuring `AbstractAuthenticationFilterConfigurer`.
AbstractConfigAttributeRequestMatcherRegistry<C>
A base class for registering `RequestMatcher`'s.
AbstractConfiguredSecurityBuilder<O,B extends SecurityBuilder<O>>
A base `SecurityBuilder` that allows `SecurityConfigurer` to be applied to it.
AbstractDaoAuthenticationConfigurer<B extends ProviderManagerBuilder<B>,C extends AbstractDaoAuthenticationConfigurer<B,C,U>,U extends org.springframework.security.core.userdetails.UserDetailsService>
Allows configuring a `DaoAuthenticationProvider`
AbstractHttpConfigurer<T extends AbstractHttpConfigurer<T,B>,B extends HttpSecurityBuilder<B>>
Adds a convenient base class for `SecurityConfigurer` instances that operate on `HttpSecurity`.
AbstractInterceptUrlConfigurer<C extends AbstractInterceptUrlConfigurer<C,H>,H extends HttpSecurityBuilder<H>>
Deprecated.
Use `AuthorizeHttpRequestsConfigurer` instead
AbstractLdapAuthenticationManagerFactory<T extends org.springframework.security.ldap.authentication.AbstractLdapAuthenticator>
Creates an `AuthenticationManager` that can perform LDAP authentication.
AbstractRequestMatcherRegistry<C>
A base class for registering `RequestMatcher`'s.
AbstractSecurityBuilder<O>
A base `SecurityBuilder` that ensures the object being built is only built one time.
AbstractSecurityWebSocketMessageBrokerConfigurer
Deprecated.
Use `EnableWebSocketSecurity` instead
AbstractServerWebExchangeMatcherRegistry<T>
AbstractUserDetailsServiceBeanDefinitionParser
AlreadyBuiltException
Thrown when `AbstractSecurityBuilder.build()` is two or more times.
AnonymousConfigurer<H extends HttpSecurityBuilder<H>>
Configures Anonymous authentication (i.e.
AuthenticationConfiguration
Exports the authentication `Configuration`
AuthenticationManagerBeanDefinitionParser
Registers the central ProviderManager used by the namespace configuration, and allows the configuration of an alias, allowing users to reference it in their beans and clearly see where the name is coming from.
AuthenticationManagerBeanDefinitionParser.NullAuthenticationProvider
Provider which doesn't provide any service.
AuthenticationManagerBuilder
`SecurityBuilder` used to create an `AuthenticationManager`.
AuthenticationManagerFactoryBean
Factory bean for the namespace AuthenticationManager, which allows a more meaningful error message to be reported in the `NoSuchBeanDefinitionException`, if the user has forgotten to declare the <authentication-manager> element.
AuthenticationProviderBeanDefinitionParser
Wraps a UserDetailsService bean with a DaoAuthenticationProvider and registers the latter with the ProviderManager.
AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder<H>>
Adds a URL based authorization using `AuthorizationManager`.
AutowiredWebSecurityConfigurersIgnoreParents
A class used to get all the `WebSecurityConfigurer` instances from the current `ApplicationContext` but ignoring the parent.
BeanIds
Contains globally used default Bean IDs for beans created by the namespace support in Spring Security 2.
ChannelAttributeFactory
Used as a factory bean to create config attribute values for the `requires-channel` attribute.
ChannelSecurityConfigurer<H extends HttpSecurityBuilder<H>>
Adds channel security (i.e.
ClientRegistrationsBeanDefinitionParser
CommonOAuth2Provider
Common OAuth2 Providers that can be used to create `builders` pre-configured with sensible defaults for the `HttpSecurity.oauth2Login()` flow.
ContextSourceSettingPostProcessor
Checks for the presence of a ContextSource instance.
CorsBeanDefinitionParser
Parser for the `CorsFilter`.
CorsConfigurer<H extends HttpSecurityBuilder<H>>
Adds `CorsFilter` to the Spring Security filter chain.
CsrfBeanDefinitionParser
Parser for the `CsrfFilter`.
CsrfConfigurer<H extends HttpSecurityBuilder<H>>
Adds CSRF protection for the methods as specified by `CsrfConfigurer.requireCsrfProtectionMatcher(RequestMatcher)`.
Customizer<T>
Callback interface that accepts a single input argument and returns no result.
DaoAuthenticationConfigurer<B extends ProviderManagerBuilder<B>,U extends org.springframework.security.core.userdetails.UserDetailsService>
Allows configuring a `DaoAuthenticationProvider`
DebugBeanDefinitionParser
DefaultFilterChainValidator
DefaultLoginPageConfigurer<H extends HttpSecurityBuilder<H>>
Adds a Filter that will generate a login page if one is not specified otherwise when using `EnableWebSecurity`.
Elements
Contains all the element names used by Spring Security 3 namespace support.
EmbeddedLdapServerContextSourceFactoryBean
Creates a `DefaultSpringSecurityContextSource` used to perform LDAP authentication and starts and in-memory LDAP server.
EnableGlobalAuthentication
The `EnableGlobalAuthentication` annotation signals that the annotated class can be used to configure a global instance of `AuthenticationManagerBuilder`.
EnableGlobalMethodSecurity
Deprecated.
Use `EnableMethodSecurity` instead
EnableMethodSecurity
Enables Spring Security Method Security.
EnableReactiveMethodSecurity
EnableRSocketSecurity
Add this annotation to a `Configuration` class to have Spring Security `RSocketSecurity` support added.
EnableWebFluxSecurity
Add this annotation to a `Configuration` class to have Spring Security WebFlux support added.
EnableWebMvcSecurity
Deprecated.
Use EnableWebSecurity instead which will automatically add the Spring MVC related Security items.
EnableWebSecurity
Add this annotation to an `@Configuration` class to have the Spring Security configuration defined in any `WebSecurityConfigurer` or more likely by exposing a `SecurityFilterChain` bean:
EnableWebSocketSecurity
Allows configuring WebSocket Authorization.
ExceptionHandlingConfigurer<H extends HttpSecurityBuilder<H>>
Adds exception handling for Spring Security related exceptions to an application.
ExpressionUrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>
Deprecated.
Use `AuthorizeHttpRequestsConfigurer` instead
FilterChainBeanDefinitionParser
FilterChainMapBeanDefinitionDecorator
Sets the filter chain Map for a FilterChainProxy bean declaration.
FilterInvocationSecurityMetadataSourceParser
Deprecated.
Use `use-authorization-manager` property instead
FormLoginBeanDefinitionParser
FormLoginConfigurer<H extends HttpSecurityBuilder<H>>
Adds form based authentication.
GlobalAuthenticationConfigurerAdapter
A `SecurityConfigurer` that can be exposed as a bean to configure the global `AuthenticationManagerBuilder`.
GlobalMethodSecurityBeanDefinitionParser
Deprecated.
Use `MethodSecurityBeanDefinitionParser` instead
GlobalMethodSecurityConfiguration
Deprecated.
Use `PrePostMethodSecurityConfiguration`, `SecuredMethodSecurityConfiguration`, or `Jsr250MethodSecurityConfiguration` instead
GrantedAuthorityDefaults
Allows providing defaults for `GrantedAuthority`
HeadersBeanDefinitionParser
Parser for the `HeadersFilter`.
HeadersConfigurer<H extends HttpSecurityBuilder<H>>
Adds the Security HTTP headers to the response.
HttpBasicConfigurer<B extends HttpSecurityBuilder<B>>
Adds HTTP basic based authentication.
HttpFirewallBeanDefinitionParser
Injects the supplied `HttpFirewall` bean reference into the `FilterChainProxy`.
HttpSecurity
A `HttpSecurity` is similar to Spring Security's XML <http> element in the namespace configuration.
HttpSecurityBeanDefinitionParser
Sets up HTTP security: filter stack and protected URLs.
HttpSecurityBeanDefinitionParser.ChildAuthenticationManagerFactoryBean
HttpSecurityBeanDefinitionParser.FilterChainDecoratorFactory
HttpSecurityBeanDefinitionParser.RequestRejectedHandlerPostProcessor
HttpSecurityBuilder<H extends HttpSecurityBuilder<H>>
InMemoryUserDetailsManagerConfigurer<B extends ProviderManagerBuilder<B>>
Configures an `AuthenticationManagerBuilder` to have in memory authentication.
InterceptMethodsBeanDefinitionDecorator
JdbcUserDetailsManagerConfigurer<B extends ProviderManagerBuilder<B>>
Configures an `AuthenticationManagerBuilder` to have JDBC authentication.
JdbcUserServiceBeanDefinitionParser
JeeConfigurer<H extends HttpSecurityBuilder<H>>
Adds support for J2EE pre authentication.
LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuilder<B>>
Configures LDAP `AuthenticationProvider` in the `ProviderManagerBuilder`.
LdapBindAuthenticationManagerFactory
Creates an `AuthenticationManager` that can perform LDAP authentication using bind authentication.
LdapPasswordComparisonAuthenticationManagerFactory
Creates an `AuthenticationManager` that can perform LDAP authentication using password comparison.
LdapProviderBeanDefinitionParser
Ldap authentication provider namespace configuration.
LdapServerBeanDefinitionParser
LdapUserServiceBeanDefinitionParser
LogoutConfigurer<H extends HttpSecurityBuilder<H>>
Adds logout support.
MatcherType
Defines the `RequestMatcher` types supported by the namespace.
MessageSecurityMetadataSourceRegistry
Deprecated.
Use `MessageMatcherDelegatingAuthorizationManager` instead
MethodSecurityBeanDefinitionParser
Processes the top-level "method-security" element.
MethodSecurityBeanDefinitionParser.Jsr250AuthorizationMethodInterceptor
MethodSecurityBeanDefinitionParser.MethodSecurityExpressionHandlerBean
MethodSecurityBeanDefinitionParser.PostAuthorizeAuthorizationMethodInterceptor
MethodSecurityBeanDefinitionParser.PreAuthorizeAuthorizationMethodInterceptor
MethodSecurityBeanDefinitionParser.SecuredAuthorizationMethodInterceptor
MethodSecurityMetadataSourceBeanDefinitionParser
Deprecated.
Use `<intercept-methods>`, `<method-security>`, or `@EnableMethodSecurity`
OAuth2ClientConfigurer<B extends HttpSecurityBuilder<B>>
An `AbstractHttpConfigurer` for OAuth 2.0 Client support.
OAuth2LoginConfigurer<B extends HttpSecurityBuilder<B>>
An `AbstractHttpConfigurer` for OAuth 2.0 Login, which leverages the OAuth 2.0 Authorization Code Grant Flow.
OAuth2ResourceServerConfigurer<H extends HttpSecurityBuilder<H>>
An `AbstractHttpConfigurer` for OAuth 2.0 Resource Server Support.
ObjectPostProcessor<T>
Deprecated.
please use `ObjectPostProcessor` instead
ObjectPostProcessor<T>
Allows initialization of Objects.
ObjectPostProcessorConfiguration
Spring `Configuration` that exports the default `ObjectPostProcessor`.
OidcBackChannelLogoutHandler
A `LogoutHandler` that locates the sessions associated with a given OIDC Back-Channel Logout Token and invalidates each one.
OidcBackChannelServerLogoutHandler
A `ServerLogoutHandler` that locates the sessions associated with a given OIDC Back-Channel Logout Token and invalidates each one.
OidcLogoutConfigurer<B extends HttpSecurityBuilder<B>>
An `AbstractHttpConfigurer` for OIDC Logout flows
OneTimeTokenLoginConfigurer<H extends HttpSecurityBuilder<H>>
PasswordEncoderParser
Stateful parser for the <password-encoder> element.
PasswordManagementConfigurer<B extends HttpSecurityBuilder<B>>
Adds password management support.
PayloadInterceptorOrder
The standard order for `PayloadInterceptor` to be sorted.
PortMapperConfigurer<H extends HttpSecurityBuilder<H>>
Allows configuring a shared `PortMapper` instance used to determine the ports when redirecting between HTTP and HTTPS.
ProviderManagerBuilder<B extends ProviderManagerBuilder<B>>
Interface for operating on a SecurityBuilder that creates a `ProviderManager`
ReactiveUserDetailsServiceResourceFactoryBean
Constructs an `MapReactiveUserDetailsService` from a resource using `UserDetailsResourceFactoryBean`.
RelyingPartyRegistrationsBeanDefinitionParser
RememberMeConfigurer<H extends HttpSecurityBuilder<H>>
Configures Remember Me authentication.
RequestCacheConfigurer<H extends HttpSecurityBuilder<H>>
Adds request cache for Spring Security.
RsaKeyConversionServicePostProcessor
Adds `RsaKeyConverters` to the configured `ConversionService` or `PropertyEditor`s
RSocketSecurity
Allows configuring RSocket based security.
Saml2LoginConfigurer<B extends HttpSecurityBuilder<B>>
An `AbstractHttpConfigurer` for SAML 2.0 Login, which leverages the SAML 2.0 Web Browser Single Sign On (WebSSO) Flow.
Saml2LogoutConfigurer<H extends HttpSecurityBuilder<H>>
Adds SAML 2.0 logout support.
Saml2MetadataConfigurer<H extends HttpSecurityBuilder<H>>
An `AbstractHttpConfigurer` for SAML 2.0 Metadata.
SecurityBuilder<O>
Interface for building an Object
SecurityConfigurer<O,B extends SecurityBuilder<O>>
Allows for configuring a `SecurityBuilder`.
SecurityConfigurerAdapter<O,B extends SecurityBuilder<O>>
A base class for `SecurityConfigurer` that allows subclasses to only implement the methods they are interested in.
SecurityContextConfigurer<H extends HttpSecurityBuilder<H>>
Allows persisting and restoring of the `SecurityContext` found on the `SecurityContextHolder` for each request by configuring the `SecurityContextPersistenceFilter`.
SecurityDebugBeanFactoryPostProcessor
SecurityNamespaceHandler
Parses elements from the "security" namespace (http://www.springframework.org/schema/security).
SecurityObservationSettings
An `ObservationPredicate` that can be used to change which Spring Security observations are made with Micrometer.
SecurityObservationSettings.Builder
A builder for configuring a `SecurityObservationSettings`
SecurityWebFiltersOrder
ServerHttpSecurity
A `ServerHttpSecurity` is similar to Spring Security's `HttpSecurity` but for WebFlux.
ServletApiConfigurer<H extends HttpSecurityBuilder<H>>
Implements select methods from the `HttpServletRequest` using the `SecurityContext` from the `SecurityContextHolder`.
SessionCreationPolicy
Specifies the various session creation policies for Spring Security.
SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
Allows configuring session management.
UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>
Deprecated.
Use `AuthorizeHttpRequestsConfigurer` instead
UserDetailsAwareConfigurer<B extends ProviderManagerBuilder<B>,U extends org.springframework.security.core.userdetails.UserDetailsService>
Base class that allows access to the `UserDetailsService` for using as a default value with `AuthenticationManagerBuilder`.
UserDetailsManagerConfigurer<B extends ProviderManagerBuilder<B>,C extends UserDetailsManagerConfigurer<B,C>>
Base class for populating an `AuthenticationManagerBuilder` with a `UserDetailsManager`.
UserDetailsManagerResourceFactoryBean
Constructs an `InMemoryUserDetailsManager` from a resource using `UserDetailsResourceFactoryBean`.
UserDetailsMapFactoryBean
Creates a `Collection<UserDetails>` from a @{code Map} in the format of
UserDetailsResourceFactoryBean
Parses a Resource that is a Properties file in the format of: `username=password[,enabled|disabled],roles...`
UserDetailsServiceConfigurer<B extends ProviderManagerBuilder<B>,C extends UserDetailsServiceConfigurer<B,C,U>,U extends org.springframework.security.core.userdetails.UserDetailsService>
Allows configuring a `UserDetailsService` within a `AuthenticationManagerBuilder`.
UserDetailsServiceFactoryBean
Bean used to lookup a named UserDetailsService or AuthenticationUserDetailsService.
UserServiceBeanDefinitionParser
WebAuthnConfigurer<H extends HttpSecurityBuilder<H>>
Configures WebAuthn for Spring Security applications
WebMvcSecurityConfiguration
Deprecated.
This is applied internally using SpringWebMvcImportSelector
WebSecurity
The `WebSecurity` is created by `WebSecurityConfiguration` to create the `FilterChainProxy` known as the Spring Security Filter Chain (springSecurityFilterChain).
WebSecurityConfiguration
Uses a `WebSecurity` to create the `FilterChainProxy` that performs the web based security for Spring Security.
WebSecurityConfigurer<T extends SecurityBuilder<jakarta.servlet.Filter>>
Allows customization to the `WebSecurity`.
WebSecurityCustomizer
Callback interface for customizing `WebSecurity`.
WebSocketMessageBrokerSecurityBeanDefinitionParser
Parses Spring Security's websocket namespace support.
WellKnownChangePasswordBeanDefinitionParser
The bean definition parser for a Well-Known URL for Changing Passwords.
X509Configurer<H extends HttpSecurityBuilder<H>>
Adds X509 based pre authentication to an application.