Spring Security Web Configurer Adapter
You don't need to build this as one line. You could try splitting it out into multiple lines and add some comments to describe what you are doing.

I think the below example does what you want.


I have removed the anonymous RequestMatcher class. RegexRequestMatcher implements the RequestMatcher interface.
I have removed the second csrf() method call as it isn't needed.



@Override
protected void configure(final HttpSecurity http) throws Exception {

    // Enable csrf for login form
    http.csrf().requireCsrfProtectionMatcher(new RegexRequestMatcher("/login/*", null));
    // Configure login page
    http.formLogin().loginPage("/login").failureUrl("/login?error").usernameParameter("username").passwordParameter("password");
    // Configure logout redirect
    http.logout().logoutSuccessUrl("/");
    // Ensure admin pages have correct role
    http.authorizeRequests().antMatchers("/admin/**").hasRole("ADMIN");
    // Configure access denied exception redirect
    http.exceptionHandling().accessDeniedPage("/403");

}