config/src/main/java/org/springframework/security/config/http/HttpSecurityBeanDefinitionParser.java
private BeanReference createFilterChain(Element element, ParserContext pc) {
		boolean secured = !OPT_SECURITY_NONE.equals(element.getAttribute(ATT_SECURED));

		if (!secured) {
			if (!StringUtils.hasText(element.getAttribute(ATT_PATH_PATTERN))
					&& !StringUtils.hasText(ATT_REQUEST_MATCHER_REF)) {
				pc.getReaderContext().error(
						"The '" + ATT_SECURED
								+ "' attribute must be used in combination with"
								+ " the '" + ATT_PATH_PATTERN + "' or '"
								+ ATT_REQUEST_MATCHER_REF + "' attributes.",
						pc.extractSource(element));
			}

			for (int n = 0; n < element.getChildNodes().getLength(); n++) {
				if (element.getChildNodes().item(n) instanceof Element) {
					pc.getReaderContext().error(
							"If you are using <http> to define an unsecured pattern, "
									+ "it cannot contain child elements.",
							pc.extractSource(element));
				}
			}

			return createSecurityFilterChainBean(element, pc, Collections.emptyList());
		}

		final BeanReference portMapper = createPortMapper(element, pc);
		final BeanReference portResolver = createPortResolver(portMapper, pc);

		ManagedList<BeanReference> authenticationProviders = new ManagedList<>();
		BeanReference authenticationManager = createAuthenticationManager(element, pc,
				authenticationProviders);

		boolean forceAutoConfig = isDefaultHttpConfig(element);
		HttpConfigurationBuilder httpBldr = new HttpConfigurationBuilder(element,
				forceAutoConfig, pc, portMapper, portResolver, authenticationManager);

		AuthenticationConfigBuilder authBldr = new AuthenticationConfigBuilder(element,
				forceAutoConfig, pc, httpBldr.getSessionCreationPolicy(),
				httpBldr.getRequestCache(), authenticationManager,
				httpBldr.getSessionStrategy(), portMapper, portResolver,
				httpBldr.getCsrfLogoutHandler());

		httpBldr.setLogoutHandlers(authBldr.getLogoutHandlers());
		httpBldr.setEntryPoint(authBldr.getEntryPointBean());
		httpBldr.setAccessDeniedHandler(authBldr.getAccessDeniedHandlerBean());

		authenticationProviders.addAll(authBldr.getProviders());

		List<OrderDecorator> unorderedFilterChain = new ArrayList<>();

		unorderedFilterChain.addAll(httpBldr.getFilters());
		unorderedFilterChain.addAll(authBldr.getFilters());
		unorderedFilterChain.addAll(buildCustomFilterList(element, pc));

		Collections.sort(unorderedFilterChain, new OrderComparator());
		checkFilterChainOrder(unorderedFilterChain, pc, pc.extractSource(element));

		// The list of filter beans
		List<BeanMetadataElement> filterChain = new ManagedList<>();

		for (OrderDecorator od : unorderedFilterChain) {
			filterChain.add(od.bean);
		}

		return createSecurityFilterChainBean(element, pc, filterChain);
	}
private BeanReference createFilterChain(Element element, ParserContext pc) {
		boolean secured = !OPT_SECURITY_NONE.equals(element.getAttribute(ATT_SECURED));

		if (!secured) {
			if (!StringUtils.hasText(element.getAttribute(ATT_PATH_PATTERN))
					&& !StringUtils.hasText(ATT_REQUEST_MATCHER_REF)) {
				pc.getReaderContext().error(
						"The '" + ATT_SECURED
								+ "' attribute must be used in combination with"
								+ " the '" + ATT_PATH_PATTERN + "' or '"
								+ ATT_REQUEST_MATCHER_REF + "' attributes.",
						pc.extractSource(element));
			}

			for (int n = 0; n < element.getChildNodes().getLength(); n++) {
				if (element.getChildNodes().item(n) instanceof Element) {
					pc.getReaderContext().error(
							"If you are using <http> to define an unsecured pattern, "
									+ "it cannot contain child elements.",
							pc.extractSource(element));
				}
			}

			return createSecurityFilterChainBean(element, pc, Collections.emptyList());
		}

		final BeanReference portMapper = createPortMapper(element, pc);
		final BeanReference portResolver = createPortResolver(portMapper, pc);

		ManagedList<BeanReference> authenticationProviders = new ManagedList<>();
		BeanReference authenticationManager = createAuthenticationManager(element, pc,
				authenticationProviders);

		boolean forceAutoConfig = isDefaultHttpConfig(element);
		HttpConfigurationBuilder httpBldr = new HttpConfigurationBuilder(element,
				forceAutoConfig, pc, portMapper, portResolver, authenticationManager);

		AuthenticationConfigBuilder authBldr = new AuthenticationConfigBuilder(element,
				forceAutoConfig, pc, httpBldr.getSessionCreationPolicy(),
				httpBldr.getRequestCache(), authenticationManager,
				httpBldr.getSessionStrategy(), portMapper, portResolver,
				httpBldr.getCsrfLogoutHandler());

		httpBldr.setLogoutHandlers(authBldr.getLogoutHandlers());
		httpBldr.setEntryPoint(authBldr.getEntryPointBean());
		httpBldr.setAccessDeniedHandler(authBldr.getAccessDeniedHandlerBean());

		authenticationProviders.addAll(authBldr.getProviders());

		List<OrderDecorator> unorderedFilterChain = new ArrayList<>();

		unorderedFilterChain.addAll(httpBldr.getFilters());
		unorderedFilterChain.addAll(authBldr.getFilters());
		unorderedFilterChain.addAll(buildCustomFilterList(element, pc));

		Collections.sort(unorderedFilterChain, new OrderComparator());
		checkFilterChainOrder(unorderedFilterChain, pc, pc.extractSource(element));

		// The list of filter beans
		List<BeanMetadataElement> filterChain = new ManagedList<>();

		for (OrderDecorator od : unorderedFilterChain) {
			filterChain.add(od.bean);
		}

		return createSecurityFilterChainBean(element, pc, filterChain);
	}
private BeanReference createFilterChain ( Element element , ParserContext pc ) { boolean secured = ! OPT_SECURITY_NONE . equals ( element . getAttribute ( ATT_SECURED ) ) ; if ( ! secured ) { if ( ! StringUtils . hasText ( element . getAttribute ( ATT_PATH_PATTERN ) ) && ! StringUtils . hasText ( ATT_REQUEST_MATCHER_REF ) ) { pc . getReaderContext ( ) . error ( "The '" + ATT_SECURED + "' attribute must be used in combination with" + " the '" + ATT_PATH_PATTERN + "' or '" + ATT_REQUEST_MATCHER_REF + "' attributes." , pc . extractSource ( element ) ) ; } for ( int n = 0 ; n < element . getChildNodes ( ) . getLength ( ) ; n ++ ) { if ( element . getChildNodes ( ) . item ( n ) instanceof Element ) { pc . getReaderContext ( ) . error ( "If you are using <http> to define an unsecured pattern, " + "it cannot contain child elements." , pc . extractSource ( element ) ) ; } } return createSecurityFilterChainBean ( element , pc , Collections . emptyList ( ) ) ; } final BeanReference portMapper = createPortMapper ( element , pc ) ; final BeanReference portResolver = createPortResolver ( portMapper , pc ) ; ManagedList < BeanReference > authenticationProviders = new ManagedList <> ( ) ; BeanReference authenticationManager = createAuthenticationManager ( element , pc , authenticationProviders ) ; boolean forceAutoConfig = isDefaultHttpConfig ( element ) ; HttpConfigurationBuilder httpBldr = new HttpConfigurationBuilder ( element , forceAutoConfig , pc , portMapper , portResolver , authenticationManager ) ; AuthenticationConfigBuilder authBldr = new AuthenticationConfigBuilder ( element , forceAutoConfig , pc , httpBldr . getSessionCreationPolicy ( ) , httpBldr . getRequestCache ( ) , authenticationManager , httpBldr . getSessionStrategy ( ) , portMapper , portResolver , httpBldr . getCsrfLogoutHandler ( ) ) ; httpBldr . setLogoutHandlers ( authBldr . getLogoutHandlers ( ) ) ; httpBldr . setEntryPoint ( authBldr . getEntryPointBean ( ) ) ; httpBldr . setAccessDeniedHandler ( authBldr . getAccessDeniedHandlerBean ( ) ) ; authenticationProviders . addAll ( authBldr . getProviders ( ) ) ; List < OrderDecorator > unorderedFilterChain = new ArrayList <> ( ) ; unorderedFilterChain . addAll ( httpBldr . getFilters ( ) ) ; unorderedFilterChain . addAll ( authBldr . getFilters ( ) ) ; unorderedFilterChain . addAll ( buildCustomFilterList ( element , pc ) ) ; Collections . sort ( unorderedFilterChain , new OrderComparator ( ) ) ; checkFilterChainOrder ( unorderedFilterChain , pc , pc . extractSource ( element ) ) ; // The list of filter beans List < BeanMetadataElement > filterChain = new ManagedList <> ( ) ; for ( OrderDecorator od : unorderedFilterChain ) { filterChain . add ( od . bean ) ; } return createSecurityFilterChainBean ( element , pc , filterChain ) ; }
Creates the {@code SecurityFilterChain} bean from an &lt;http&gt; element.
Creates the {