title: Why classes extending WebSecurityConfigurerAdapter and not declaring any bean are annotated with configuration?
body: <p>According to <a href="https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/context/annotation/Configuration.html" rel="nofollow noreferrer">@Configuration documentation</a>:</p>
  
  <blockquote>
    <p>Indicates that a <strong>class declares one or more @Bean methods</strong> and may be processed by the Spring container to generate bean definitions and service requests for those beans at runtime, for example:  </p>
  </blockquote>
  
  <pre><code>@Configuration  
  public class AppConfig {  
    @Bean  
    public MyBean myBean() {  
      //instantiate, configure and return bean ...  
    }  
  }
  </code></pre>
  
  <p>As I remember always I came across classes extending <code>WebSecurityConfigurerAdapter</code> which didn't contain any <code>@Bean</code> methods and were annotated with <code>@Configuration</code>.
  It is even in official blog and some examples, see:
  <a href="https://spring.io/blog/2013/07/03/spring-security-java-config-preview-web-security" rel="nofollow noreferrer">https://spring.io/blog/2013/07/03/spring-security-java-config-preview-web-security</a></p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class HelloWebSecurityConfiguration
     extends WebSecurityConfigurerAdapter {
  
    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) {
      auth
        .inMemoryAuthentication()
          .withUser("user").password("password").roles("USER");
    }
  }
  </code></pre>
  
  <p>or here: <a href="https://docs.spring.io/spring-security/site/docs/current/reference/html/jc.html" rel="nofollow noreferrer">https://docs.spring.io/spring-security/site/docs/current/reference/html/jc.html</a></p>
  
  <pre><code>    @Order(1)                                                        2
      public static class ApiWebSecurityConfigurationAdapter extends WebSecurityConfigurerAdapter {
          protected void configure(HttpSecurity http) throws Exception {
              http
                  .antMatcher("/api/**")                               3
                  .authorizeRequests(authorizeRequests -&gt;
                      authorizeRequests
                          .anyRequest().hasRole("ADMIN")
                  )
                  .httpBasic(withDefaults());
          }
      }
  </code></pre>
  
  <p>Why this classes are annotated with <code>@Configuration</code> even though there are no <code>@Bean</code> methods?</p>