Java @EnableWebSecurity 和 @EnableWebMvcSecurity 有什么区别？

What is the difference between @EnableWebSecurity and @EnableWebMvcSecurity?

提问by Mike R

@EnableWebSecurity

@启用网络安全

The JavaDoc documentaion:

JavaDoc 文档：

Add this annotation to an @Configurationclass to have the Spring Securityconfiguration defined in any WebSecurityConfigureror more likely by extending the WebSecurityConfigurerAdapterbase class and overriding individual methods.

通过扩展基类和覆盖单个方法，将此注释添加到@Configuration类中以Spring Security在任何WebSecurityConfigurer或更可能的情况下定义配置WebSecurityConfigurerAdapter。

@EnableWebMvcSecurity

@EnableWebMvcSecurity

The JavaDoc documentaion:

JavaDoc 文档：

Add this annotation to an @Configurationclass to have the Spring Securityconfiguration integrate with Spring MVC.

将此批注添加到@Configuration类中以将Spring Security配置与Spring MVC.

• What exactly does it mean to 'integrate with Spring MVC' ? What extra behaviors do I get?
• I found guides& answers, which suggest that this annotation adds CSRF Tokensto Spring MVCForms, is this the only thing it adds?

• “与 Spring MVC 集成”到底是什么意思？我会得到哪些额外的行为？
• 我找到了guides& answers，这表明这个注释添加CSRF Tokens到Spring MVC表单中，这是它添加的唯一内容吗？

采纳答案by Steve

If you take a look at those classes, @EnableWebMvcSecurityactually adds the @EnableWebSecurityannotation in WebMvcSecurityConfiguration. Therefore, @EnableWebMvcSecuritydoes everything that @EnableWebSecuritydoes, and a bit more.

如果你看看那些类，@EnableWebMvcSecurity实际上@EnableWebSecurity在WebMvcSecurityConfiguration. 因此，@EnableWebMvcSecurity做所有@EnableWebSecurity能做的事，甚至更多。

What more you ask?

你还问什么？

If you look at WebMvcSecurityConfiguration, you will see that it adds an AuthenticationPrincipalArgumentResolverso that you can access the authentication principal by adding an annotation to a controller method argument. i.e.:

如果您查看WebMvcSecurityConfiguration，您将看到它添加了 ，AuthenticationPrincipalArgumentResolver以便您可以通过向控制器方法参数添加注释来访问身份验证主体。IE：

public String show(@AuthenticationPrincipal CustomUser customUser) {
    // do something with CustomUser
    return "view";
}

It also integrates with Spring Web MVC to add a CSRF token to forms.

它还与 Spring Web MVC 集成以向表单添加 CSRF 令牌。

回答by Cassian

As of Spring Security 4.0, @EnableWebMvcSecurityis deprecated. The replacement is @EnableWebSecuritywhich will determine adding the Spring MVC features based upon the classpath.

To enable Spring Security integration with Spring MVC add the@EnableWebSecurityannotation to your configuration.

从 Spring Security 4.0 开始，@EnableWebMvcSecurity已弃用。替换 @EnableWebSecurity将根据类路径确定添加 Spring MVC 功能。

要启用 Spring Security 与 Spring MVC 的集成，请将注释添加@EnableWebSecurity到您的配置中。

source

来源