title: Annotating WebSecurityConfigurerAdapter with @Configuration causes config to be invoked twice
body: <p>When I create a <code>WebSecurityConfigurerAdapter</code> it is getting registered twice. I've created a configuration exactly the same as the Hello <a href="http://docs.spring.io/spring-security/site/docs/3.2.5.RELEASE/reference/htmlsingle/#hello-web-security-java-configuration" rel="nofollow noreferrer">Web Security Java Configuration</a> example from the reference docs.</p>
  
  <p>The configuration is working as expected, though beans and the filter chain gets registered twice as shown in the tomcat output.</p>
  
  <pre><code>00:32:01 INFO : Root WebApplicationContext: initialization started
  00:32:01 INFO : Refreshing Root WebApplicationContext: startup date [Thu Oct 09 00:32:01 EST 2014]; root of context hierarchy
  00:32:01 INFO : Registering annotated classes: [class com.acme.app.config.SecurityConfig]
  ______________
  00:32:02 INFO : Creating filter chain: org.springframework.security.web.util.matcher.AnyRequestMatcher@1, [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@26eed435, org.springframework.security.web.context.SecurityContextPersistenceFilter@cd9947, org.springframework.security.web.header.HeaderWriterFilter@354e8394, org.springframework.security.web.csrf.CsrfFilter@54fb62e3, org.springframework.security.web.authentication.logout.LogoutFilter@1df9cd96, org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@4da923c6, org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter@1ee94efd, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@7d4b5722, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@26dde6a8, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@7c58b660, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@6fd12384, org.springframework.security.web.session.SessionManagementFilter@24d4cc75, org.springframework.security.web.access.ExceptionTranslationFilter@1709e92c, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@2c46f137]
  00:32:02 INFO : Root WebApplicationContext: initialization completed in 565 ms
  00:32:02 INFO : FrameworkServlet 'dispatcher': initialization started
  00:32:02 INFO : Refreshing WebApplicationContext for namespace 'dispatcher-servlet': startup date [Thu Oct 09 00:32:02 EST 2014]; parent: Root WebApplicationContext
  00:32:02 INFO : Registering annotated classes: [class com.acme.app.config.WebConfig]
  ______________
  00:32:02 INFO : Creating filter chain: org.springframework.security.web.util.matcher.AnyRequestMatcher@1, [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@52b26dcb, org.springframework.security.web.context.SecurityContextPersistenceFilter@10f4b535, org.springframework.security.web.header.HeaderWriterFilter@561ad054, org.springframework.security.web.csrf.CsrfFilter@4b6e4b62, org.springframework.security.web.authentication.logout.LogoutFilter@1d424a71, org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@2dad3bf4, org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter@282a0f5c, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@52eeebb7, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@47d4a88e, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@474c5850, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@6fdc40f8, org.springframework.security.web.session.SessionManagementFilter@2978de23, org.springframework.security.web.access.ExceptionTranslationFilter@5bf190dd, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@22b3fc11]
  </code></pre>
  
  <p><strong>AppInitializer.java</strong></p>
  
  <pre><code>public class AppInitializer
          extends AbstractAnnotationConfigDispatcherServletInitializer {
  
      @Override
      protected Class&lt;?&gt;[] getRootConfigClasses() {
          return new Class[]{SecurityConfig.class};
      }
  
      @Override
      protected Class&lt;?&gt;[] getServletConfigClasses() {
          return new Class[]{WebConfig.class};
      }
  
      @Override
      protected String[] getServletMappings() {
          return new String[]{"/"};
      }
  
  }
  </code></pre>
  
  <p><strong>SecurityConfig.java</strong></p>
  
  <pre><code>@Configuration
  @EnableWebMvcSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Autowired
      public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
          System.out.println("______________");
          auth
                  .inMemoryAuthentication()
                  .withUser("user").password("password").roles("USER");
      }
  
  }
  </code></pre>
  
  <p><strong>SecurityWebApplicationInitializer.java</strong></p>
  
  <pre><code>public class SecurityWebApplicationInitializer
          extends AbstractSecurityWebApplicationInitializer {
  
  }
  </code></pre>
  
  <p><strong>WebConfig.java</strong></p>
  
  <pre><code>@Configuration
  @EnableWebMvc
  @ComponentScan(basePackages = "com.acme.app")
  public class WebConfig extends WebMvcConfigurerAdapter {
  
      @Override
      public void addResourceHandlers(ResourceHandlerRegistry registry) {
          registry.addResourceHandler("/static/**")
                  .addResourceLocations("/static/");
      }
  
      @Bean
      public CookieLocaleResolver getLocaleResolver() {
          CookieLocaleResolver bean = new CookieLocaleResolver();
          bean.setCookieName("clientlanguage");
          bean.setCookieMaxAge(100000);
          return bean;
      }
  
      @Override
      public void addInterceptors(InterceptorRegistry registry) {
          LocaleChangeInterceptor lci = new LocaleChangeInterceptor();
          lci.setParamName("lang");
          registry.addInterceptor(lci);
      }
  
      @Bean
      public TilesConfigurer getTilesConfigurer() {
          CustomTilesInitializer ti = new CustomTilesInitializer();
          TilesConfigurer res = new TilesConfigurer();
          res.setCompleteAutoload(true);
          res.setDefinitions("/WEB-INF/**/tiles.xml");
          return res;
      }
  
      @Override
      public void configureViewResolvers(ViewResolverRegistry registry) {
          registry.tiles();
      }
  
      @Override
      public void addViewControllers(ViewControllerRegistry registry) {
          registry.addViewController("/").setViewName("home");
          registry.addRedirectViewController("/home", "/");
          registry.addViewController("/login").setViewName("login");
          registry.addViewController("/aboutme").setViewName("aboutme");
      }
  
  }
  </code></pre>
  
  <p><strong>UPDATE</strong></p>
  
  <p>As @lkrnac has pointed out with <a href="https://stackoverflow.com/a/26258804/140037">his answer</a> that the config is being loaded twice during the <code>WebConfig</code> <code>@ComponentScan</code> annotation. I had figured that spring would be smart enough to not load a config that it had previously loaded. I could locate the classes outside of the config namespace though that seems like a nuisance. Instead I have chosen to provide an exclude filter as in the following:</p>
  
  <pre><code>@ComponentScan(basePackages = "com.acme.app",
                 excludeFilters = {
                     @Filter(type = ASSIGNABLE_TYPE,
                             value = {
                                 WebConfig.class,
                                 SecurityConfig.class
                             })
                 })
  </code></pre>
  
  <p>This way I can freely still create new config classes for my web context without having to worry about them being included or not.</p>