{"action":"opened","issue":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5990","repository_url":"https://api.github.com/repos/spring-projects/spring-boot","labels_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5990/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5990/comments","events_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5990/events","html_url":"https://github.com/spring-projects/spring-boot/issues/5990","id":155562806,"number":5990,"title":"Potentially useless @Order annotation on IgnoredPathsWebSecurityConfigurerAdapter","user":{"login":"berniegp","id":881558,"avatar_url":"https://avatars.githubusercontent.com/u/881558?v=3","gravatar_id":"","url":"https://api.github.com/users/berniegp","html_url":"https://github.com/berniegp","followers_url":"https://api.github.com/users/berniegp/followers","following_url":"https://api.github.com/users/berniegp/following{/other_user}","gists_url":"https://api.github.com/users/berniegp/gists{/gist_id}","starred_url":"https://api.github.com/users/berniegp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/berniegp/subscriptions","organizations_url":"https://api.github.com/users/berniegp/orgs","repos_url":"https://api.github.com/users/berniegp/repos","events_url":"https://api.github.com/users/berniegp/events{/privacy}","received_events_url":"https://api.github.com/users/berniegp/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2016-05-18T17:51:29Z","updated_at":"2016-05-18T17:51:29Z","closed_at":null,"body":"Spring Boot version: 1.3.5\r\n\r\nI spent some time trying to understand how bean wiring and autoconfiguration works when Spring Security is on the class path. During my investigation, I think I found two usages of `@Order` which do nothing.\r\n\r\nHere are the relevant snippets:\r\n1.\r\n\r\n\t@Configuration\r\n\t@ConditionalOnWebApplication\r\n\t@ConditionalOnClass({ EnableWebSecurity.class })\r\n\t@AutoConfigureAfter(SecurityAutoConfiguration.class)\r\n\t@AutoConfigureBefore(FallbackWebSecurityAutoConfiguration.class)\r\n\t@EnableConfigurationProperties\r\n\tpublic class ManagementWebSecurityAutoConfiguration {\r\n\r\n\t\t// snip\r\n\r\n\t\t// This is the bean with id \"ignoredPathsWebSecurityConfigurerAdapter\" which is used\r\n\t\t// when both the actuator and Spring-Security are on the classpath.\r\n\t\t@Bean\r\n\t\t@ConditionalOnMissingBean({ IgnoredPathsWebSecurityConfigurerAdapter.class })\r\n\t\tpublic IgnoredPathsWebSecurityConfigurerAdapter ignoredPathsWebSecurityConfigurerAdapter() {\r\n\t\t\treturn new IgnoredPathsWebSecurityConfigurerAdapter();\r\n\t\t}\r\n\r\n\t\t// snip\r\n\r\n\t\t// Get the ignored paths in early\r\n\t\t@Order(SecurityProperties.IGNORED_ORDER + 1)\r\n\t\t// ^^ If I understand correctly, @Order only has any effect when placed on other annotated\r\n\t\t// elements (beans, configuration, event listeners, etc.) In this instance, shouldn't the\r\n\t\t// @Order annotation be placed in the @Bean provider method? (or just removed since it has\r\n\t\t// no effect)\r\n\t\tprivate static class IgnoredPathsWebSecurityConfigurerAdapter\r\n\t\t\t\timplements WebSecurityConfigurer<WebSecurity> {\r\n\r\n\t\t\t\t// snip\r\n\t\t}\r\n\r\n\t\t// snip\r\n\t}\r\n\r\n2.\r\n\r\n\t@Configuration\r\n\t@EnableConfigurationProperties\r\n\t@ConditionalOnClass({ EnableWebSecurity.class, AuthenticationEntryPoint.class })\r\n\t@ConditionalOnMissingBean(WebSecurityConfiguration.class)\r\n\t@ConditionalOnWebApplication\r\n\t@EnableWebSecurity\r\n\tpublic class SpringBootWebSecurityConfiguration {\r\n\r\n\t\tprivate static List<String> DEFAULT_IGNORED = Arrays.asList(\"/css/**\", \"/js/**\",\r\n\t\t\t\t\"/images/**\", \"/**/favicon.ico\");\r\n\r\n\t\t@Bean\r\n\t\t@ConditionalOnMissingBean({ IgnoredPathsWebSecurityConfigurerAdapter.class })\r\n\t\tpublic IgnoredPathsWebSecurityConfigurerAdapter ignoredPathsWebSecurityConfigurerAdapter() {\r\n\t\t\treturn new IgnoredPathsWebSecurityConfigurerAdapter();\r\n\t\t}\r\n\r\n\t\t// snip\r\n\t\t\r\n\t\t// Get the ignored paths in early\r\n\t\t@Order(SecurityProperties.IGNORED_ORDER)\r\n\t\t// ^^ same comment as above\r\n\t\tprivate static class IgnoredPathsWebSecurityConfigurerAdapter\r\n\t\t\t\timplements WebSecurityConfigurer<WebSecurity> {\r\n\r\n\t\t\t// snip\r\n\t\t}\r\n\t}\r\n\r\nIf I'm right, this is pretty innocuous, but it can confuse developers who look at the code (it did for me!)."}}