@Override
	protected void configure(HttpSecurity http) throws Exception {

		final RequestMatcher textHtmlMatcher = new MediaTypeRequestMatcher(
				contentNegotiationStrategy,
				MediaType.TEXT_HTML);

		final String loginPage = "/admin-ui/#/login";

		final BasicAuthenticationEntryPoint basicAuthenticationEntryPoint = new BasicAuthenticationEntryPoint();
		basicAuthenticationEntryPoint.setRealmName(realm);
		basicAuthenticationEntryPoint.afterPropertiesSet();

		ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry security = http
				.csrf()
				.disable()
				.authorizeRequests()
				.antMatchers("/")
				.authenticated()
				.antMatchers("/admin-ui/**").permitAll()
				.antMatchers("/authenticate").permitAll()
				.antMatchers("/security/info").permitAll()
				.antMatchers("/assets/**").permitAll();

		security = configureSimpleSecurity(security);

		security.and()
				.formLogin().loginPage(loginPage)
				.loginProcessingUrl("/admin-ui/login")
				.defaultSuccessUrl("/admin-ui/").permitAll()
				.and().logout().logoutUrl("/admin-ui/logout").logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler())
				.permitAll()
				.and().httpBasic()
				.and().exceptionHandling()
				.defaultAuthenticationEntryPointFor(
						new LoginUrlAuthenticationEntryPoint(loginPage),
						textHtmlMatcher)
				.defaultAuthenticationEntryPointFor(basicAuthenticationEntryPoint,
						AnyRequestMatcher.INSTANCE);

		security.anyRequest().denyAll();

		final SessionRepositoryFilter<ExpiringSession> sessionRepositoryFilter = new SessionRepositoryFilter<ExpiringSession>(
				sessionRepository());
		sessionRepositoryFilter
				.setHttpSessionStrategy(new HeaderHttpSessionStrategy());

		http.addFilterBefore(sessionRepositoryFilter,
				ChannelProcessingFilter.class).csrf().disable();
		http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
	}
Setup Spring Security for the http endpoints of the application.

@author Gunnar Hillert
@author Eric Bottard
spring-xd-ui/src/main/java/org/springframework/xd/dirt/web/config/SecurityConfiguration.java