public HttpSecurity configureHttpSecurity(final HttpSecurity http, final ApplicationContext applicationContext) throws Exception {
        http
            .cors(Customizer.withDefaults())
            .csrf(AbstractHttpConfigurer::disable)
            .headers(AbstractHttpConfigurer::disable)
            .logout(AbstractHttpConfigurer::disable)
            .requiresChannel(customizer -> customizer.requestMatchers(r -> r.getHeader("X-Forwarded-Proto") != null).requiresSecure());

        val patterns = getAllowedPatternsToIgnore();
        LOGGER.debug("Configuring protocol endpoints [{}] to exclude/ignore from http security", patterns);
        val requests = http.authorizeHttpRequests(customizer -> {
            val matchers = patterns
                .stream()
                .map(url -> PathPatternRequestMatcher.withDefaults().matcher(url))
                .toList()
                .toArray(new RequestMatcher[0]);
            customizer.requestMatchers(matchers).permitAll();
        });
        webSecurityConfigurers
            .stream()
            .filter(BeanSupplier::isNotProxy)
            .forEach(Unchecked.consumer(cfg -> cfg.configure(http)));

        val endpoints = casProperties.getMonitor().getEndpoints().getEndpoint();
        endpoints.forEach(Unchecked.biConsumer((key, endpointProps) -> {
            val endpoint = EndpointRequest.to(key);
            endpointProps.getAccess().forEach(Unchecked.consumer(
                access -> configureEndpointAccess(requests, access, endpointProps, endpoint)));
        }));
        configureEndpointAccessToDenyUndefined(requests, applicationContext);
        configureEndpointAccessForStaticResources(requests);
        configureEndpointAccessByFormLogin(requests);

        val jaas = casProperties.getMonitor().getEndpoints().getJaas();
        FunctionUtils.doIfNotNull(jaas.getLoginConfig(), __ -> configureJaasAuthenticationProvider(http, jaas));

        http.securityContext(securityContext -> securityContext.securityContextRepository(securityContextRepository));
        webSecurityConfigurers
            .stream()
            .filter(BeanSupplier::isNotProxy)
            .forEach(Unchecked.consumer(cfg -> cfg.finish(http)));
        return http;
    }
Configure http security.

@param http the http
@return the http security
@throws Exception the exception
support/cas-server-support-webconfig/src/main/java/org/apereo/cas/web/security/CasWebSecurityConfigurerAdapter.java