Spring Security annotation configuration regarding web.xml

Question

I'm using annotation based configuration and so far worked without a web.xml.

Now, according to documentation, I'll need to create a web.xml file and add these fields to it:

<filter>
  <filter-name>springSecurityFilterChain</filter-name>
  <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
  <filter-name>springSecurityFilterChain</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

Can I configure this too with annotations?

Because If I make a web.xml and put only this, I'll get some other errors in runtime (like missing ContextLoaderListener etc etc..).

jasop · Accepted Answer · 2012-08-03T02:34:15.320

web.xml is part of the standard web-application packaging structure. This structure allows you to deploy your packaged war file on different servers such as Tomcat and Jetty.

You can read more about web.xml here: http://en.wikipedia.org/wiki/Deployment_descriptor

You can read about the standard directory structure here (this is for Tomcat, but most web-servers follow the same/similar structure): http://tomcat.apache.org/tomcat-6.0-doc/appdev/deployment.html#Standard_Directory_Layout

You should already have a web.xml if your application is a web-application. If not, then you should not create a web.xml but find another way of hooking in Spring Security. Please let us know how your application is currently deployed.

Here is an example of a web.xml for Spring with Spring Security:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app
    PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
    "http://java.sun.com/dtd/web-app_2_3.dtd">

<web-app>

    <!-- Spring Security Filter -->
<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

    <filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

    <listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<listener>
    <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
</listener>

    <!-- The front controller of the Spring MVC Web application, responsible 
    for handling all application requests -->
<servlet>
    <servlet-name>Spring MVC Dispatcher Servlet</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            /WEB-INF/web-application-config.xml
        </param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
</servlet>

<!-- Map requests to the DispatcherServlet for handling -->
<servlet-mapping>
    <servlet-name>Spring MVC Dispatcher Servlet</servlet-name>
    <url-pattern>/app/*</url-pattern>
</servlet-mapping>

    <welcome-file-list>
    <welcome-file>index.jsp</welcome-file>
</welcome-file-list>

</web-app>

After all I guess I'll have to include a web.xml. The thing is that with Spring 3.1 you can delete the web.xml and continue only with annotation based configuration. But for cases like these - I can't find suitable annotations or ways of specifying the configuration in the Java class. Also for things like `` I also have to include the web.xml, so this is a reason enough. — Martin Spa, Aug 03 '12 at 06:23
I'll add one more commment, instead of pointing to the XML Spring configuration, the web-application-config.xml, I can tell that the configuration is annotation driven, like in this example: https://gist.github.com/1299632 — Martin Spa, Aug 03 '12 at 06:57
Yes that's correct. If you want to use @Configuration to configure your beans you can use AnnotationConfigWebApplicationContext in your web.xml. I think this method is the newest and best way. I will have to update my project to follow it! — jasop, Aug 03 '12 at 07:54

score 1 · Answer 2 · answered Aug 03 '12 at 02:25

1

For a web app you need a web.xml.

Regarding your error missing ContextLoaderListener, just add this to the web.xml

<listener>
<listener-class>
    org.springframework.web.context.ContextLoaderListener
</listener-class>
</listener>

answered Aug 03 '12 at 02:25

shazinltc

3,616
7
34
49

Yep I said that :) but the thing is I'll need to add more stuff too, but in the end maybe it's the way it has to be. – Martin Spa Aug 03 '12 at 06:28
:) your web.xml is not going to more than a couple of lines. As you said, rest you can have an @configuration class and configure your beans there.. – shazinltc Aug 04 '12 at 04:39

Spring Security annotation configuration regarding web.xml

2 Answers2