How do I lazy load Spring Security?

Question

How do I not instantiate Spring Security until I need to?

I'm using Google App Engine so the startup time of my web app is important. Sometimes when a user requests a page, they must wait the whole time for my web app instantiate before getting a response (this is called a loading request).

Certain pages of my app require no authentication. For these pages, if the request is a loading request, I don't want the user to have to wait the extra ~1.5 seconds for Spring Security to instantiate.

I've already figured out how to lazy load all of the other components of my app, Spring Security is the only one I don't know how. Anyone have an idea?

EDIT: If anyone knows how to instantiate Spring Security from code instead of using applicationContext-security.xml, then I think I could figure out how to lazy load it.

Answer 1

You can configure <url-pattern>s of Spring Security filter mapping in web.xml to match the secured resources only (as well as login-logout pages and other resources which require the Spring Security processing), and wrap the default filter with your own lazy wrapper, as you did with DispatcherServlet.

EDIT: The problem seems to be more complex than I thought. You can also try to define your security xml as <beans default-lazy-init="true" ...>

Answer 2

Well, I finally figured it out. I had to subclass org.springframework.web.context.ContextLoaderListener and org.springframework.web.filter.DelegatingFilterProxy to not do anything until I call an activate method on them.