title: Configure Spring Security without XML in Spring 4
body: <p>I want to use a <code>custom authentication filter</code> that:</p>
  
  <ol>
  <li>captures an encrypted header token</li>
  <li>after validating it, extracts the user's details and adds them to the current request's security context in a stateless way </li>
  </ol>
  
  <p><em>I want to be able to use this security context holder to get the details about the current requesting user correctly handle their requests.</em></p>
  
  <pre><code>@RequestMapping(value = "/simple", method = RequestMethod.POST)
  @ResponseBody
  @Transactional
  @Preauthorize(...)
  public String simple(){
     //collect the user's current details from the getPrinciple() and complete the transaction...
      Object principal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
      return "Simple";
  }
  </code></pre>
  
  <p>I have done this before in XML like so: </p>
  
  <pre><code>&lt;beans xmlns="http://www.springframework.org/schema/beans"
      xmlns:security="http://www.springframework.org/schema/security"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://www.springframework.org/schema/beans
  http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
  http://www.springframework.org/schema/security
  http://www.springframework.org/schema/security/spring-security-3.2.xsd"&gt;
  
      &lt;security:global-method-security
          secured-annotations="enabled" /&gt;
  
      &lt;security:http pattern="/**"
          auto-config="true" disable-url-rewriting="true" use-expressions="true"&gt;
          &lt;security:custom-filter ref="authenticationTokenProcessingFilter"
              position="FORM_LOGIN_FILTER" /&gt;
          &lt;security:intercept-url pattern="/authenticate"
              access="permitAll" /&gt;
          &lt;security:intercept-url pattern="/secure/**"
              access="isAuthenticated()" /&gt;
      &lt;/security:http&gt;
  
      &lt;bean id="CustomAuthenticationEntryPoint" class="org.foo.CustomAuthenticationEntryPoint" /&gt;
  
      &lt;bean class="org.foo.AuthenticationTokenProcessingFilter" id="authenticationTokenProcessingFilter"&gt;
          &lt;constructor-arg ref="authenticationManager" /&gt;
      &lt;/bean&gt;
  
  &lt;/beans&gt;
  </code></pre>
  
  <p>However, I want this to work with a newer <code>Spring Boot</code> application in a non-xml WebSecurityConfigurerAdapter like the example in their Spring Boot files:</p>
  
  <pre><code>    @Bean
      public ApplicationSecurity applicationSecurity() {
          return new ApplicationSecurity();
      }
  
      @Order(Ordered.LOWEST_PRECEDENCE - 8)
      protected static class ApplicationSecurity extends WebSecurityConfigurerAdapter {
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              // this is obviously for a simple "login page" not a custom filter!
  http.authorizeRequests().anyRequest().fullyAuthenticated().and().formLogin()
                          .loginPage("/login").failureUrl("/login?error").permitAll(); 
              }
          }
  </code></pre>
  
  <p>Any advice or similar examples out there?</p>