/**
 * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 *
 * This file is licensed under the Apache License, Version 2.0 (the "License").
 * You may not use this file except in compliance with the License. A copy of
 * the License is located at
 *
 * http://aws.amazon.com/apache2.0/
 *
 * This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
 * CONDITIONS OF ANY KIND, either express or implied. See the License for the
 * specific language governing permissions and limitations under the License.
 *
 */

package com.example.secureweb;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .authorizeRequests()
                .antMatchers(
                        "/js/**",
                        "/css/**",
                        "/img/**",
                        "/webjars/**").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login")
                .permitAll()
                .and()
                .logout()
                .invalidateHttpSession(true)
                .clearAuthentication(true)
                .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                .logoutSuccessUrl("/login?logout")
                .permitAll();

        http.csrf().disable();
    }

    @Bean
    @Override
    public UserDetailsService userDetailsService() {
        UserDetails user =
                User.withDefaultPasswordEncoder()
                        .username("user")
                        .password("password")
                        .roles("USER")
                        .build();

        return new InMemoryUserDetailsManager(user);
    }
}

@@ -694,24 +694,133 @@
 iguration;%0D%0A
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;%0D%0A
 import org.s
@@ -1125,245 +1125,110 @@
 ty.c
-ore.userdetails.User;%0D%0Aimport org.springframework.security.core.userdetails.UserDetails;%0D%0Aimport org.springframework.security.core.userdetails.UserDetailsService;%0D%0Aimport org.springframework.security.provisioning.InMemoryUserDetailsManag
+rypto.bcrypt.BCryptPasswordEncoder;%0D%0Aimport org.springframework.security.crypto.password.PasswordEncod
 er;%0D
@@ -2256,17 +2256,8 @@
 %0D%0A%0D%0A
-    @Bean
 %0D%0A  
@@ -2278,118 +2278,160 @@
    p
-ublic UserDetailsService userDetailsService() %7B%0D%0A        UserDetails user =%0D%0A                User.withDefaultP
+rotected void configure(AuthenticationManagerBuilder auth) throws Exception %7B%0D%0A        auth.inMemoryAuthentication()%0D%0A                .passwordEncoder(p
 assw
@@ -2442,26 +2442,19 @@
 ncoder()
+)
 %0D%0A
-        
         
@@ -2466,16 +2466,16 @@
    .
-username
+withUser
 (%22us
@@ -2476,32 +2476,24 @@
 er(%22user%22)%0D%0A
-        
             
@@ -2506,16 +2506,41 @@
 assword(
+passwordEncoder().encode(
 %22passwor
@@ -2542,16 +2542,17 @@
 ssword%22)
+)
 %0D%0A      
@@ -2561,24 +2561,16 @@
         
-      
-  
 .roles(%22
@@ -2579,97 +2579,120 @@
 ER%22)
+;
 %0D%0A    
-                    .build();%0D%0A%0D%0A        return new InMemoryUserDetailsManager(user
+%7D%0D%0A%0D%0A    @Bean%0D%0A    public PasswordEncoder passwordEncoder() %7B%0D%0A        return new BCryptPasswordEncoder(
 );%0D%0A
@@ -2698,11 +2698,13 @@
 %0A    %7D%0D%0A
+%0D%0A
 %7D%0D%0A

Update WebSecurityConfig.java