title: java Spring @EnableResourceServer and @EnableWebSecurity
body: <p>I have <strong>RESTful</strong> spring resource server with <code>@EnableResourceServer</code> and extending <code>ResourceServerConfigurerAdapter</code></p>
  
  <p>In <a href="https://docs.spring.io/spring-security/oauth/apidocs/org/springframework/security/oauth2/config/annotation/web/configuration/EnableResourceServer.html" rel="nofollow noreferrer">documentations</a> says: </p>
  
  <blockquote>
    <p>...In order to use this filter you must @EnableWebSecurity somewhere in your application, either in the same place as you use this annotation, or somewhere else.</p>
  </blockquote>
  
  <p>But when I get to the <code>public @interface EnableResourceServer</code> I see <code>ResourceServerConfiguration extends WebSecurityConfigurerAdapter</code>.</p>
  
  <p><strong>Question:</strong>
  So what do I need for pure RESTful API?</p>
  
  <ol>
  <li><code>@EnableWebSecurity</code> on any <code>@Config</code></li>
  <li>Extend the <code>WebSecurityConfigurerAdapter</code>?</li>
  <li>1 + 2</li>
  <li>Neither</li>
  </ol>
  
  <p>My config</p>
  
  <pre><code>@Configuration
  @EnableResourceServer
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class HGResourceServerConfigurerAdapter extends ResourceServerConfigurerAdapter {
  
      @Override
      public void configure(HttpSecurity httpSecurity) throws Exception {
          httpSecurity
          .cors().disable()
          .csrf().disable()
          .formLogin().disable()
          .httpBasic().disable()
          .jee().disable()
          .logout().disable()
          .rememberMe().disable()
          .servletApi().disable()
          .x509().disable()
          .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
          .and().authorizeRequests().antMatchers(HttpMethod.OPTIONS, "/**").permitAll()
          .and().authorizeRequests().antMatchers(Url.API_ERROR_LOGS_FRONTEND).permitAll()
          .and().authorizeRequests().antMatchers(Url.API_REGISTER_PATH).permitAll()
          .and().authorizeRequests().antMatchers(Url.API_VERIFY_EMAIL_PATH).permitAll()
          .and().authorizeRequests().antMatchers(Url.API_RESET_PASSWORD_PATH).permitAll()
          .and().authorizeRequests().antMatchers(Url.API_CONFIRM_RESET_PASSWORD_PATH).permitAll()
          .and().authorizeRequests().anyRequest().authenticated();
      }
  
      @Primary
      @Bean
      public RemoteTokenServices tokenService() {
          RemoteTokenServices tokenService = new RemoteTokenServices();
          tokenService.setCheckTokenEndpointUrl("http://localhost:8081/oauth/check_token");
          tokenService.setClientId("client");
          tokenService.setClientSecret("secret");
          return tokenService;
      }
  
  
      //disable default user creation
      @Bean
      public UserDetailsService userDetailsService() throws Exception {
          return new InMemoryUserDetailsManager();
      }
  
      //password encoder
      @Bean
      public PasswordEncoder passwordEncoder() {
          return new BCryptPasswordEncoder();
      }
  }
  </code></pre>