Spring Security’s Java Configuration does not expose every property of every object that it configures. This simplifies the configuration for a majority of users. Afterall, if every property was exposed, users could use standard bean configuration.

Spring Security的Java配置不會公開它配置的每個物件的每個屬性。這簡化了大多數使用者的配置。畢竟，如果每個屬性都被暴露，使用者可以使用標準bean配置。   While there are good reasons to not directly expose every property, users may still need more advanced configuration options. To address this Spring Security introduces the concept of an  ObjectPostProcessor which can be used to modify or replace many of the Object instances created by the Java Configuration. For example, if you wanted to configure the  filterSecurityPublishAuthorizationSuccess property on  FilterSecurityInterceptor you could use the following:   雖然有充分的理由不直接公開每個屬性，但使用者可能仍需要更高階的配置選項。為了解決這個問題，Spring Security引入了ObjectPostProcessor的概念，可用於修改或替換Java Configuration建立的許多Object例項。例如，如果要在FilterSecurityInterceptor上配置filterSecurityPublishAuthorizationSuccess屬性，可以使用以下命令：

@Override
protected void configure(HttpSecurity http) throws Exception {
	http
		.authorizeRequests()
			.anyRequest().authenticated()
			.withObjectPostProcessor(new ObjectPostProcessor<FilterSecurityInterceptor>() {
				public <O extends FilterSecurityInterceptor> O postProcess(
						O fsi) {
					fsi.setPublishAuthorizationSuccess(true);
					return fsi;
				}
			});
}

5.10 Custom DSLs

You can provide your own custom DSLs in Spring Security. For example, you might have something that looks like this:

您可以在Spring Security中提供自己的自定義DSL。例如，您可能看起來像這樣：  

public class MyCustomDsl extends AbstractHttpConfigurer<CorsConfigurerMyCustomDsl, HttpSecurity> {
	private boolean flag;

	@Override
	public void init(H http) throws Exception {
		// any method that adds another configurer
		// must be done in the init method
		http.csrf().disable();
	}

	@Override
	public void configure(H http) throws Exception {
		ApplicationContext context = http.getSharedObject(ApplicationContext.class);

		// here we lookup from the ApplicationContext. You can also just create a new instance.
		MyFilter myFilter = context.getBean(MyFilter.class);
		myFilter.setFlag(flag);
		http.addFilterBefore(myFilter, UsernamePasswordAuthenticationFilter.class);
	}

	public MyCustomDsl flag(boolean value) {
		this.flag = value;
		return this;
	}

	public static MyCustomDsl customDsl() {
		return new MyCustomDsl();
	}
}

This is actually how methods like HttpSecurity.authorizeRequests() are implemented.

這實際上是如何實現HttpSecurity.authorizeRequests（）之類的方法。   The custom DSL can then be used like this: 然後可以像這樣使用自定義DSL：  

@EnableWebSecurity
public class Config extends WebSecurityConfigurerAdapter {
	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http
			.apply(customDsl())
				.flag(true)
				.and()
			...;
	}
}

The code is invoked in the following order:

程式碼按以下順序呼叫：

• Code in `Config`s configure method is invoked
• Code in `MyCustomDsl`s init method is invoked
• Code in `MyCustomDsl`s configure method is invoked

If you want, you can have WebSecurityConfiguerAdapter add MyCustomDsl by default by using SpringFactories. For example, you would create a resource on the classpath named META-INF/spring.factories with the following contents:

如果需要，可以使用SpringFactories預設新增WebSecurityConfiguerAdapter新增MyCustomDsl。例如，您將在名為META-INF / spring.factories的類路徑上建立一個具有以下內容的資源：   META-INF/spring.factories. 

org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer = sample.MyCustomDsl

Users wishing to disable the default can do so explicitly.

希望禁用預設值的使用者可以明確地這樣做。  

@EnableWebSecurity
public class Config extends WebSecurityConfigurerAdapter {
	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http
			.apply(customDsl()).disable()
			...;
	}
}