Spring Security 6.1 - Lambda DSL for Custom DSL

Question

In Spring Security 6.1, SecurityConfigurerAdapter::and has been deprecated for removal, and clients are encouraged to use the Lambda DSL: https://docs.spring.io/spring-security/reference/migration-7/configuration.html#_use_the_lambda_dsl

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/blog/**").permitAll()
                .anyRequest().authenticated()
            )
            .formLogin(formLogin -> formLogin
                .loginPage("/login")
                .permitAll()
            )
            .rememberMe(Customizer.withDefaults());

        return http.build();
    }
}

Meanwhile, the documentation for Custom DSLs still show use of the apply()-and() pattern: https://docs.spring.io/spring-security/reference/servlet/configuration/java.html#jc-custom-dsls

@Configuration
@EnableWebSecurity
public class Config {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .apply(customDsl())
                .flag(true)
                .and()
            ...;
        return http.build();
    }
}

I don't see a mechanism in HttpSecurity or AbstractConfiguredSecurityBuilder to follow the lambda pattern for a custom AbstractHttpConfigurer, such as:

@Configuration
@EnableWebSecurity
public class Config {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .apply(customDsl(), custom -> custom
                .flag(true)
            )
            ...;
        return http.build();
    }
}

So I'm stuck using the deprecated and() method if I want to keep the single-statement method-chaining pattern, until a future release adds a replacement for this pattern for Custom DSL.

Am I missing something?

Answer 1

I had the same question and found these two issues in the Spring Security repository: 13436 and 13204. It looks like there will be a new .with() method which will replace .apply().and(). This seems to be the one they are talking about: https://github.com/spring-projects/spring-security/blob/main/config/src/main/java/org/springframework/security/config/annotation/AbstractConfiguredSecurityBuilder.java#L155. It is already part of the 6.2.0-M1 release.

Edit: Found the pull request: https://github.com/spring-projects/spring-security/pull/13432