Spring Security: Configure debug mode programmatically

PublishedJuly 14, 2023

•2 min read•View as Markdown

Spring Security: Configure debug mode programmatically

Joseph Gan

Advocate for better developer's productivity and experience

Documenting my learnings and sharing it

Comments

Join the discussion

No comments yet. Be the first to comment.

More from this blog

Mastering GitLab Parent‑Child Pipelines: Scalable CI for Multi‑Module Maven Monorepos

Background Recently, I redesigned my team's pipeline running on a multi-module Maven monorepo using GitLab CI. It wasn't that the previous setup was broken, but my team faced a few persistent issues t

Jun 5, 202614 min read64

Mastering GitLab Parent‑Child Pipelines: Scalable CI for Multi‑Module Maven Monorepos

Spring Security's SecurityContext get unexpectedly cleared in a MockMvc Test

Background At work, there’s some test written where I wanted to query the database (repository) after mockMvc request has been made to verify the result. This is a very simple illustration of what it looks like. @SpringBootTest @AutoConfigureMockMvc ...

Jun 14, 20253 min read156

Spring Security's SecurityContext get unexpectedly cleared in a MockMvc Test

Setting up MongoDB with replicas for local development

It's been a long time coming, but I finally came around to set up MongoDB with replicas for local development. TLDR; clone the repository, run docker compose up -d, and you are good to go! If you want to know more, continue to read below. Context Run...

Jan 13, 20243 min read887

Setting up MongoDB with replicas for local development

Lesson learned while using Taskfile to invoke PowerShell command

Context I recently came across TaskFile and wanted to use it to automate some of my workflows, which underlying invokes PowerShell commands. However, I faced several errors while doing so, and this post is to reflect on it, and hopefully help myself ...

Oct 30, 20234 min read625

Lesson learned while using Taskfile to invoke PowerShell command

Reclaim disk space used by Docker Desktop (WSL2)

Problem I was always out of disk space in my C drive, and even though I clear my stuff often, I notice that my space is never reclaimed, instead, it kept going down. I used WizTree to view which file is taking up my disk space, and I noticed this No...

Oct 21, 20232 min read3.7K

Reclaim disk space used by Docker Desktop (WSL2)

Joseph Gan's Blog

32 posts

Introduction

If you have used Spring Security before, you will likely enable the debug mode at some point

@Configuration @EnableWebSecurity(debug = true) public class WebSecurityConfiguration { // omit }

Start the application and you will see the following logs

2023-07-14T23:13:12.247+08:00 INFO 17416 --- [ restartedMain] w.s.c.ServletWebServerApplicationContext : Root WebApplicationContext: initialization completed in 2822 ms 2023-07-14T23:13:12.546+08:00 WARN 17416 --- [ restartedMain] .s.s.UserDetailsServiceAutoConfiguration : Using generated security password: e636b35a-35c2-4df8-8404-8a51eb3bfdaa This generated password is for development use only. Your security configuration must be updated before running your application in production. 2023-07-14T23:13:12.721+08:00 INFO 17416 --- [ restartedMain] o.s.s.web.DefaultSecurityFilterChain : Will secure any request with [org.springframework.security.web.session.DisableEncodeUrlFilter@4c6333b3, org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@7e78bb13, org.springframework.security.web.context.SecurityContextHolderFilter@500ccd39, org.springframework.security.web.header.HeaderWriterFilter@67b36e1e, org.springframework.security.web.csrf.CsrfFilter@547cf6f9, org.springframework.security.web.authentication.logout.LogoutFilter@6af43e35, org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@784d6d5e, org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter@3e7757, org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter@55145899, org.springframework.security.web.authentication.www.BasicAuthenticationFilter@5aed1894, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@49d3c0d7, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@62359ec7, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@22520f84, org.springframework.security.web.access.ExceptionTranslationFilter@394bab9, org.springframework.security.web.access.intercept.AuthorizationFilter@665a6be5] 2023-07-14T23:13:12.754+08:00 WARN 17416 --- [ restartedMain] o.s.s.c.a.web.builders.WebSecurity : ******************************************************************** ********** Security debugging is enabled. ************* ********** This may include sensitive information. ************* ********** Do not use in a production system! ************* ******************************************************************** 2023-07-14T23:13:13.188+08:00 INFO 17416 --- [ restartedMain] o.s.b.d.a.OptionalLiveReloadServer : LiveReload server is running on port 35729

What if you want to toggle the debug mode programmatically? It will be difficult to do so since it is configured at the annotation level. Is there any other way to configure it? Fortunately, yes! By using WebSecurityCustomizer class

@Configuration @EnableWebSecurity public class WebSecurityConfiguration { @Bean public WebSecurityCustomizer webSecurityCustomizer() { return (web) -> web.debug(true); } }

That's great. Can it be better, such as toggling it via properties?

@Configuration @EnableWebSecurity public class WebSecurityConfiguration { @Value("${web.security.debug}") private boolean enableDebug; @Bean public WebSecurityCustomizer webSecurityCustomizer() { return (web) -> web.debug(enableDebug); } }

In application.properties, define the following property

web.security.debug=true

In production, it can also easily be toggled via the environment variable

WEB_SECURITY_DEBUG: false

Spring Security: Configure debug mode programmatically

Comments

More from this blog

Mastering GitLab Parent‑Child Pipelines: Scalable CI for Multi‑Module Maven Monorepos

Spring Security's SecurityContext get unexpectedly cleared in a MockMvc Test

Setting up MongoDB with replicas for local development

Lesson learned while using Taskfile to invoke PowerShell command

Reclaim disk space used by Docker Desktop (WSL2)

Introduction

Conclusion

Source Code

Command Palette

Comments

More from this blog

Introduction

Conclusion

Source Code