As per spring docs
Add this annotation to an
@Configurationclass to have the Spring Security configuration defined in anyWebSecurit
@EnableWebSecurity is used for spring security java configuration. Add this annotation with @configuration on top of your security java class that extends WebSecurityConfigurerAdapter.
Override the configure(WebSecurity web) & configure(HttpSecurity http). This is the replacement of xml based configurations like and . This way you can limit requested urls coming from specific urls also enable form based log in.