Spring Migrating from spring security 3 2 6 to spring security 4 0 0
Spring Migrating from spring security 3 2 6 to spring security 4 0 0 In this post, i document some changes i went through to successfully migrate from security 3.2.6 to spring security 4.0.0 Changes in <http> in security-config.xml In security-config.xml, if you have the <http> section set to: <http auto-config="true"> For spring security 3.2.6, the following is implied: <http auto-config="true"> is same as <http auto-config="true" use-expressions="false"> For spring security 4.0.0, the following is implied instead: <http auto-config="true"> is same as <http auto-config="true" use-expressions="true"> Therefore, need to be careful if you do not use expressions, as in that case you need to set use-expressions="false" in the <http> element Changes in JSP views In spring security 4.0.0, the csrf is enabled by default, which is equivalent to: <http auto-confi...