What’s the Real Difference Between WebSecurity and HttpSecurity in Spring Security?

HttpSecurity Essence

HttpSecurity is used to build a SecurityFilterChain that contains a series of filters. A typical configuration creates a bean that returns the configured filter chain.

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
        .antMatcher("/**")
        .authorizeRequests(authorize -> authorize
            .anyRequest().authenticated()
        )
        .build();
}

The resulting SecurityFilterChain is handed over to FilterChainProxy, which may seem redundant but is necessary for managing multiple filter chains and their lifecycles.

When multiple SecurityFilterChain instances are needed for different access‑control strategies, FilterChainProxy aggregates them and also defines ignored requests, request firewalls, and rejection handlers. It is the sole entry point for Spring Security within the servlet container, working together with DelegatingFilterProxy to isolate Spring Security from the underlying servlet API.

WebSecurity Essence

WebSecurity builds the springSecurityFilterChain bean, which is essentially a FilterChainProxy. It coordinates the lifecycle of all SecurityFilterChain objects, determines which requests bypass security, and ensures proper cleanup of the SecurityContext to avoid memory leaks. It also configures the request firewall and rejection handler, and enables Spring Security debugging when required.

The underlying implementation of WebSecurity constructs a FilterChainProxy by assembling ignored request chains and the chains defined by HttpSecurity. It then returns the proxy (or a DebugFilter wrapper when debugging is enabled) as the final filter.

@Override
protected Filter performBuild() throws Exception {
    Assert.state(!this.securityFilterChainBuilders.isEmpty(),
        () -> "At least one SecurityBuilder<? extends SecurityFilterChain> needs to be specified. "
            + "Typically this is done by exposing a SecurityFilterChain bean "
            + "or by adding a @Configuration that extends WebSecurityConfigurerAdapter. "
            + "More advanced users can invoke " + WebSecurity.class.getSimpleName() + ".addSecurityFilterChainBuilder directly");
    // Build ignored request chains
    int chainSize = this.ignoredRequests.size() + this.securityFilterChainBuilders.size();
    List<SecurityFilterChain> securityFilterChains = new ArrayList<>(chainSize);
    for (RequestMatcher ignoredRequest : this.ignoredRequests) {
        securityFilterChains.add(new DefaultSecurityFilterChain(ignoredRequest));
    }
    // Build HttpSecurity defined chains
    for (SecurityBuilder<? extends SecurityFilterChain> securityFilterChainBuilder : this.securityFilterChainBuilders) {
        securityFilterChains.add(securityFilterChainBuilder.build());
    }
    FilterChainProxy filterChainProxy = new FilterChainProxy(securityFilterChains);
    if (this.httpFirewall != null) {
        filterChainProxy.setFirewall(this.httpFirewall);
    }
    if (this.requestRejectedHandler != null) {
        filterChainProxy.setRequestRejectedHandler(this.requestRejectedHandler);
    }
    filterChainProxy.afterPropertiesSet();
    Filter result = filterChainProxy;
    if (this.debugEnabled) {
        this.logger.warn("

********************************************************************
" +
            "**********        Security debugging is enabled.        *************
" +
            "**********    This may include sensitive information.  *************
" +
            "**********      Do not use in a production system!      *************
" +
            "********************************************************************

");
        result = new DebugFilter(filterChainProxy);
    }
    this.postBuildAction.run();
    return result;
}

Conclusion

In summary, WebSecurity is the external entry point of Spring Security, while HttpSecurity defines internal security policies. WebSecurity maps to FilterChainProxy, and HttpSecurity maps to SecurityFilterChain; both inherit from AbstractConfiguredSecurityBuilder. Understanding these relationships clarifies their distinct roles.