I need to migrate a legacy Spring Security configuration to Spring 6. It includes several .sessionManagement()
parts, which are hard to understand for a beginner. Maybe they can be simplified? The old code also uses and()
, which is deprecated. (all other deprecated parts are easy to migrate to Spring 6)
http
.antMatcher("/service/**")
.headers().disable()
.csrf().disable()
.cors().disable()
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
.sessionFixation().none()
.and()
.authorizeRequests(authorizeRequests ->
authorizeRequests
.antMatchers("/service/**").hasRole(requiredRole)
)
.authenticationProvider(someAuthenticationProvider)
.httpBasic()
.and()
.sessionManagement().sessionFixation().migrateSession()
;
Is it possible to simplify the .sessionManagement()
parts?
How can the deprecated .and()
parts be migrated?