Add withDefaults method and use it instead of apply method

config/src/main/java/org/springframework/security/config/annotation/AbstractConfiguredSecurityBuilder.java

@@ -161,6 +161,10 @@ public <C extends SecurityConfigurerAdapter<O, B>> B with(C configurer, Customiz
 		return (B) this;
 	}
 
+	public <C extends SecurityConfigurerAdapter<O, B>> B withDefaults(C configurer) throws Exception {
+		return with(configurer, Customizer.withDefaults());
+	}
+
 	/**
 	 * Sets an object that is shared by multiple {@link SecurityConfigurer}.
 	 * @param sharedType the Class to key the shared object by.

config/src/main/java/org/springframework/security/config/annotation/SecurityConfigurerAdapter.java

@@ -83,7 +83,7 @@ public void addObjectPostProcessor(ObjectPostProcessor<?> objectPostProcessor) {
 
 	/**
 	 * Sets the {@link SecurityBuilder} to be used. This is automatically set when using
-	 * {@link AbstractConfiguredSecurityBuilder#apply(SecurityConfigurerAdapter)}
+	 * {@link AbstractConfiguredSecurityBuilder#withDefaults(SecurityConfigurerAdapter)}
 	 * @param builder the {@link SecurityBuilder} to set
 	 */
 	public void setBuilder(B builder) {

config/src/main/java/org/springframework/security/config/annotation/authentication/builders/AuthenticationManagerBuilder.java

@@ -195,7 +195,9 @@ public <T extends UserDetailsService> DaoAuthenticationConfigurer<Authentication
 	 * @throws Exception if an error occurs when adding the LDAP authentication
 	 */
 	public LdapAuthenticationProviderConfigurer<AuthenticationManagerBuilder> ldapAuthentication() throws Exception {
-		return apply(new LdapAuthenticationProviderConfigurer<>());
+		LdapAuthenticationProviderConfigurer<AuthenticationManagerBuilder> configurer = new LdapAuthenticationProviderConfigurer<>();
+		withDefaults(configurer);
+		return configurer;
 	}
 
 	/**
@@ -277,7 +279,8 @@ public UserDetailsService getDefaultUserDetailsService() {
 	private <C extends UserDetailsAwareConfigurer<AuthenticationManagerBuilder, ? extends UserDetailsService>> C apply(
 			C configurer) throws Exception {
 		this.defaultUserDetailsService = configurer.getUserDetailsService();
-		return super.apply(configurer);
+		super.withDefaults(configurer);
+		return configurer;
 	}
 
 }

config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java

@@ -2232,7 +2232,8 @@ private <C extends SecurityConfigurerAdapter<DefaultSecurityFilterChain, HttpSec
 		if (existingConfig != null) {
 			return existingConfig;
 		}
-		return apply(configurer);
+		withDefaults(configurer);
+		return configurer;
 	}
 
 	private ObjectPostProcessor<AuthenticationManager> getAuthenticationManagerPostProcessor() {

config/src/main/java/org/springframework/security/config/annotation/web/configuration/HttpSecurityConfiguration.java

@@ -123,7 +123,7 @@ HttpSecurity httpSecurity() throws Exception {
 			.requestCache(withDefaults())
 			.anonymous(withDefaults())
 			.servletApi(withDefaults())
-			.apply(new DefaultLoginPageConfigurer<>());
+			.withDefaults(new DefaultLoginPageConfigurer<>());
 		http.logout(withDefaults());
 		// @formatter:on
 		applyCorsIfAvailable(http);
@@ -153,7 +153,7 @@ private void applyDefaultConfigurers(HttpSecurity http) throws Exception {
 		List<AbstractHttpConfigurer> defaultHttpConfigurers = SpringFactoriesLoader
 			.loadFactories(AbstractHttpConfigurer.class, classLoader);
 		for (AbstractHttpConfigurer configurer : defaultHttpConfigurers) {
-			http.apply(configurer);
+			http.withDefaults(configurer);
 		}
 	}
 

config/src/main/kotlin/org/springframework/security/config/annotation/web/HttpSecurityDsl.kt

@@ -106,7 +106,8 @@ class HttpSecurityDsl(private val http: HttpSecurity, private val init: HttpSecu
         configurer: C,
         configuration: C.() -> Unit = { }
     ): C {
-        return this.http.apply(configurer).apply(configuration)
+        this.http.withDefaults(configurer)
+        return configurer.apply(configuration)
     }
 
     /**

config/src/test/java/org/springframework/security/config/annotation/web/AbstractConfiguredSecurityBuilderTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -60,8 +60,8 @@ public void objectPostProcessorWhenNullThenThrowIllegalArgumentException() {
 
 	@Test
 	public void applyWhenDuplicateConfigurerAddedThenDuplicateConfigurerRemoved() throws Exception {
-		this.builder.apply(new TestSecurityConfigurer());
-		this.builder.apply(new TestSecurityConfigurer());
+		this.builder.withDefaults(new TestSecurityConfigurer());
+		this.builder.withDefaults(new TestSecurityConfigurer());
 		assertThat(this.builder.getConfigurers(TestSecurityConfigurer.class)).hasSize(1);
 	}
 
@@ -79,7 +79,7 @@ public void getObjectWhenNotBuiltThenThrowIllegalStateException() {
 	@Test
 	public void buildWhenConfigurerAppliesAnotherConfigurerThenObjectStillBuilds() throws Exception {
 		DelegateSecurityConfigurer.CONFIGURER = mock(SecurityConfigurer.class);
-		this.builder.apply(new DelegateSecurityConfigurer());
+		this.builder.withDefaults(new DelegateSecurityConfigurer());
 		this.builder.build();
 		verify(DelegateSecurityConfigurer.CONFIGURER).init(this.builder);
 		verify(DelegateSecurityConfigurer.CONFIGURER).configure(this.builder);
@@ -88,7 +88,7 @@ public void buildWhenConfigurerAppliesAnotherConfigurerThenObjectStillBuilds() t
 	@Test
 	public void buildWhenConfigurerAppliesAndRemoveAnotherConfigurerThenNotConfigured() throws Exception {
 		ApplyAndRemoveSecurityConfigurer.CONFIGURER = mock(SecurityConfigurer.class);
-		this.builder.apply(new ApplyAndRemoveSecurityConfigurer());
+		this.builder.withDefaults(new ApplyAndRemoveSecurityConfigurer());
 		this.builder.build();
 		verify(ApplyAndRemoveSecurityConfigurer.CONFIGURER, never()).init(this.builder);
 		verify(ApplyAndRemoveSecurityConfigurer.CONFIGURER, never()).configure(this.builder);
@@ -97,7 +97,7 @@ public void buildWhenConfigurerAppliesAndRemoveAnotherConfigurerThenNotConfigure
 	@Test
 	public void buildWhenConfigurerAppliesAndRemoveAnotherConfigurersThenNotConfigured() throws Exception {
 		ApplyAndRemoveAllSecurityConfigurer.CONFIGURER = mock(SecurityConfigurer.class);
-		this.builder.apply(new ApplyAndRemoveAllSecurityConfigurer());
+		this.builder.withDefaults(new ApplyAndRemoveAllSecurityConfigurer());
 		this.builder.build();
 		verify(ApplyAndRemoveAllSecurityConfigurer.CONFIGURER, never()).init(this.builder);
 		verify(ApplyAndRemoveAllSecurityConfigurer.CONFIGURER, never()).configure(this.builder);
@@ -107,17 +107,17 @@ public void buildWhenConfigurerAppliesAndRemoveAnotherConfigurersThenNotConfigur
 	public void getConfigurerWhenMultipleConfigurersThenThrowIllegalStateException() throws Exception {
 		TestConfiguredSecurityBuilder builder = new TestConfiguredSecurityBuilder(mock(ObjectPostProcessor.class),
 				true);
-		builder.apply(new DelegateSecurityConfigurer());
-		builder.apply(new DelegateSecurityConfigurer());
+		builder.withDefaults(new DelegateSecurityConfigurer());
+		builder.withDefaults(new DelegateSecurityConfigurer());
 		assertThatIllegalStateException().isThrownBy(() -> builder.getConfigurer(DelegateSecurityConfigurer.class));
 	}
 
 	@Test
 	public void removeConfigurerWhenMultipleConfigurersThenThrowIllegalStateException() throws Exception {
 		TestConfiguredSecurityBuilder builder = new TestConfiguredSecurityBuilder(mock(ObjectPostProcessor.class),
 				true);
-		builder.apply(new DelegateSecurityConfigurer());
-		builder.apply(new DelegateSecurityConfigurer());
+		builder.withDefaults(new DelegateSecurityConfigurer());
+		builder.withDefaults(new DelegateSecurityConfigurer());
 		assertThatIllegalStateException().isThrownBy(() -> builder.removeConfigurer(DelegateSecurityConfigurer.class));
 	}
 
@@ -127,8 +127,8 @@ public void removeConfigurersWhenMultipleConfigurersThenConfigurersRemoved() thr
 		DelegateSecurityConfigurer configurer2 = new DelegateSecurityConfigurer();
 		TestConfiguredSecurityBuilder builder = new TestConfiguredSecurityBuilder(mock(ObjectPostProcessor.class),
 				true);
-		builder.apply(configurer1);
-		builder.apply(configurer2);
+		builder.withDefaults(configurer1);
+		builder.withDefaults(configurer2);
 		List<DelegateSecurityConfigurer> removedConfigurers = builder
 			.removeConfigurers(DelegateSecurityConfigurer.class);
 		assertThat(removedConfigurers).hasSize(2);
@@ -142,8 +142,8 @@ public void getConfigurersWhenMultipleConfigurersThenConfigurersReturned() throw
 		DelegateSecurityConfigurer configurer2 = new DelegateSecurityConfigurer();
 		TestConfiguredSecurityBuilder builder = new TestConfiguredSecurityBuilder(mock(ObjectPostProcessor.class),
 				true);
-		builder.apply(configurer1);
-		builder.apply(configurer2);
+		builder.withDefaults(configurer1);
+		builder.withDefaults(configurer2);
 		List<DelegateSecurityConfigurer> configurers = builder.getConfigurers(DelegateSecurityConfigurer.class);
 		assertThat(configurers).hasSize(2);
 		assertThat(configurers).containsExactly(configurer1, configurer2);

config/src/test/java/org/springframework/security/config/annotation/web/configuration/HttpSecurityConfigurationTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -688,7 +688,7 @@ static class ApplyCustomDslConfig {
 
 		@Bean
 		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-			http.apply(CustomDsl.customDsl());
+			http.withDefaults(CustomDsl.customDsl());
 			return http.build();
 		}
 

config/src/test/java/org/springframework/security/config/http/customconfigurer/CustomHttpSecurityConfigurerTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2022 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -118,10 +118,9 @@ static class Config {
 		@Bean
 		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
 			// @formatter:off
-			http
-				.apply(CustomConfigurer.customConfigurer())
-					.loginPage("/custom");
-			return http.build();
+			return http
+					.with(CustomConfigurer.customConfigurer(), (c) -> c.loginPage("/custom"))
+					.build();
 			// @formatter:on
 		}