Spring Security and() method -

in spring framework security, there example:

http     .authorizerequests()         .anyrequest().authenticated()         .and()     .formlogin()         .loginpage("/login") 1         .permitall();   

anyone knows when and() used? defined @ expressionurlauthorizationconfigurer.expressionintercepturlregistry, not easy read springs documentation, seems designed confuse.

think of and() way chain methods together. typically use and() method after you're done configuring options on particular configurer. example,

http     .someconfigurer         .<some feature of configurer>()         .<some feature of configurer>()         .and()     .someotherconfigurer         .<some feature of someotherconfigurer>()         ...         .and()      ... 

you'll notice first level of calls on http object configurers

.formlogin() --> formloginconfigurer .httpbasic() --> httpbasicconfigurer() .sessionmanagement() --> sessionmanagementconfigurer 

the next level after configurer properties of particular configurer want tweak. e.g.

formlogin()     .loginpage("/login")     .permitall()     .and() 

the and() @ end of returns builder (httpsecurity in our case). , hence can chain other configurers using and() method.

the method comes securityconfigureradapter class. and() method in expressionurlauthorizationconfigurer.expressionintercepturlregistry in turn calls above method.