[FIXED] Why classes extending WebSecurityConfigurerAdapter and not declaring any bean are annotated with configuration?

Issue

According to @Configuration documentation:

Indicates that a class declares one or more @Bean methods and may be processed by the Spring container to generate bean definitions and service requests for those beans at runtime, for example:

@Configuration  
public class AppConfig {  
  @Bean  
  public MyBean myBean() {  
    //instantiate, configure and return bean ...  
  }  
}

As I remember always I came across classes extending WebSecurityConfigurerAdapter which didn't contain any @Bean methods and were annotated with @Configuration. It is even in official blog and some examples, see: https://spring.io/blog/2013/07/03/spring-security-java-config-preview-web-security

@Configuration
@EnableWebSecurity
public class HelloWebSecurityConfiguration
   extends WebSecurityConfigurerAdapter {

  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) {
    auth
      .inMemoryAuthentication()
        .withUser("user").password("password").roles("USER");
  }
}

or here: https://docs.spring.io/spring-security/site/docs/current/reference/html/jc.html

    @Order(1)                                                        2
    public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
        protected void configure(HttpSecurity http) throws Exception {
            http
                .antMatcher("/api/**")                               3
                .authorizeRequests(authorizeRequests ->
                    authorizeRequests
                        .anyRequest().hasRole("ADMIN")
                )
                .httpBasic(withDefaults());
        }
    }

Why this classes are annotated with @Configuration even though there are no @Bean methods?

Solution

Beans are imported using the secondary "@Enable" annotation

Spring features such as asynchronous method execution, scheduled task execution, annotation driven transaction management, and even Spring MVC can be enabled and configured from @Configuration classes using their respective "@Enable" annotations. See @EnableAsync, @EnableScheduling, @EnableTransactionManagement, @EnableAspectJAutoProxy, and @EnableWebMvc for details.

from EnableWebSecurity:

Add this annotation to an @Configuration class to have the Spring Security configuration defined in any WebSecurityConfigurer or more likely by extending the WebSecurityConfigurerAdapter base class and overriding individual methods:

Answered By - user7294900
Answer Checked By - Gilberto Lyons (JavaFixing Admin)