{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5046","repository_url":"https://api.github.com/repos/spring-projects/spring-boot","labels_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5046/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5046/comments","events_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5046/events","html_url":"https://github.com/spring-projects/spring-boot/issues/5046","id":129468942,"number":5046,"title":"Cannot modify web security without overwriting auto-configured security.","user":{"login":"OrangeDog","id":675056,"avatar_url":"https://avatars.githubusercontent.com/u/675056?v=3","gravatar_id":"","url":"https://api.github.com/users/OrangeDog","html_url":"https://github.com/OrangeDog","followers_url":"https://api.github.com/users/OrangeDog/followers","following_url":"https://api.github.com/users/OrangeDog/following{/other_user}","gists_url":"https://api.github.com/users/OrangeDog/gists{/gist_id}","starred_url":"https://api.github.com/users/OrangeDog/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OrangeDog/subscriptions","organizations_url":"https://api.github.com/users/OrangeDog/orgs","repos_url":"https://api.github.com/users/OrangeDog/repos","events_url":"https://api.github.com/users/OrangeDog/events{/privacy}","received_events_url":"https://api.github.com/users/OrangeDog/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/spring-projects/spring-boot/labels/documentation","name":"documentation","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/spring-projects/spring-boot/milestones/60","html_url":"https://github.com/spring-projects/spring-boot/milestones/1.3.3","labels_url":"https://api.github.com/repos/spring-projects/spring-boot/milestones/60/labels","id":1491835,"number":60,"title":"1.3.3","description":"","creator":{"login":"philwebb","id":519772,"avatar_url":"https://avatars.githubusercontent.com/u/519772?v=3","gravatar_id":"","url":"https://api.github.com/users/philwebb","html_url":"https://github.com/philwebb","followers_url":"https://api.github.com/users/philwebb/followers","following_url":"https://api.github.com/users/philwebb/following{/other_user}","gists_url":"https://api.github.com/users/philwebb/gists{/gist_id}","starred_url":"https://api.github.com/users/philwebb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philwebb/subscriptions","organizations_url":"https://api.github.com/users/philwebb/orgs","repos_url":"https://api.github.com/users/philwebb/repos","events_url":"https://api.github.com/users/philwebb/events{/privacy}","received_events_url":"https://api.github.com/users/philwebb/received_events","type":"User","site_admin":false},"open_issues":23,"closed_issues":8,"state":"open","created_at":"2016-01-08T16:23:19Z","updated_at":"2016-02-04T16:56:57Z","due_on":"2016-02-22T00:00:00Z","closed_at":null},"comments":10,"created_at":"2016-01-28T14:34:47Z","updated_at":"2016-02-04T19:48:21Z","closed_at":null,"body":"Despite what [the docs](https://docs.spring.io/spring-boot/docs/current/reference/html/boot-features-security.html) say\r\n\r\n> To override the access rules without changing any other auto-configured features add a `@Bean` of type `WebSecurityConfigurerAdapter` with `@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)`\r\n\r\nadding such a bean reverts everything to the spring-security defaults, ignoring any application properties. It does this even if it doesn't even override any `configure` methods.\r\n\r\nAs a non-exhaustive list: csrf is enabled, sessions are created, basic auth is disabled"},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/comments/180020657","html_url":"https://github.com/spring-projects/spring-boot/issues/5046#issuecomment-180020657","issue_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5046","id":180020657,"user":{"login":"wilkinsona","id":914682,"avatar_url":"https://avatars.githubusercontent.com/u/914682?v=3","gravatar_id":"","url":"https://api.github.com/users/wilkinsona","html_url":"https://github.com/wilkinsona","followers_url":"https://api.github.com/users/wilkinsona/followers","following_url":"https://api.github.com/users/wilkinsona/following{/other_user}","gists_url":"https://api.github.com/users/wilkinsona/gists{/gist_id}","starred_url":"https://api.github.com/users/wilkinsona/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wilkinsona/subscriptions","organizations_url":"https://api.github.com/users/wilkinsona/orgs","repos_url":"https://api.github.com/users/wilkinsona/repos","events_url":"https://api.github.com/users/wilkinsona/events{/privacy}","received_events_url":"https://api.github.com/users/wilkinsona/received_events","type":"User","site_admin":false},"created_at":"2016-02-04T19:48:21Z","updated_at":"2016-02-04T19:48:21Z","body":"I don't think it's complete fabrication, but it is a little unclear. When the documentation says \"to override the access rules without changing any other auto-configured features\", it's taking about the auto-configuration of Spring Security's servlet filter, etc. The \"access rules\" are anything that you'd configure via a `WebSecurityConfigurer` and are what you are switching off with your empty `WebSecurityConfigurerAdapter` that has higher precedence as it matches any path.\r\n\r\nI don't think that `ACCESS_OVERRIDE_ORDER` is useless. It allows you to provide a `WebSecurityConfigurer` that changes Spring Security's configuration for certain paths. Any path for which you do not provide any configuration will still fall back to Spring Boot's default configuration."}}