Configuring SecurityFilterChain

Key points

• WebSecurityConfigurerAdapter was removed in Spring Security 6. Expose a SecurityFilterChain bean instead.
• Spring Security 6 uses the lambda DSL. The old .and() chaining is deprecated and gone in 7.
• Rules match top to bottom, first match wins. A broad pattern above a narrow one silently swallows it.
• Finish with anyRequest().authenticated() so every new endpoint is locked until you say otherwise.
• Different rules for API and UI? Declare several chains, each with a securityMatcher, ordered with @Order.

Example

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    SecurityFilterChain api(HttpSecurity http) throws Exception {
        return http
            .securityMatcher("/api/**")                 // this chain only handles /api
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**").permitAll()
                .requestMatchers(HttpMethod.GET, "/api/posts/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated())          // deny by default
            .csrf(csrf -> csrf.disable())               // token API, no cookies
            .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .httpBasic(Customizer.withDefaults())
            .build();
    }
}

One bean, one chain, rules from most specific to "anyRequest().authenticated()".