如何动态排除标记@Component的自定义过滤器出Spring Security过滤器链？

问题根源 #

你的推测完全正确：Spring Boot会自动扫描所有实现Filter接口且带有@Component注解的类，将其注册到Servlet容器的全局过滤器链中，这个过程和Spring Security的SecurityFilterChain配置无关，这就是为什么你没在Security配置里显式添加该过滤器，它依然会生效的原因。

解决方案 #

方案1：用@ConditionalOnProperty实现动态开关（推荐） #

保留@Component注解，通过配置文件的开关动态决定是否创建过滤器Bean，完美满足“动态排除”需求：

修改StaticKeyAuthenticationFilter类，添加@ConditionalOnProperty注解：

@Component
@ConditionalOnProperty(name = "authorization.filter.enabled", havingValue = "true", matchIfMissing = true)
public class StaticKeyAuthenticationFilter implements Filter {

    @Value("${authorization.key}")
    private String authorizationKey;

    private final Logger logger = Logger.getLogger(StaticKeyAuthenticationFilter.class.getName());

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        // 原有逻辑保持不变
    }
}

然后在yml配置文件中通过参数控制：

# 启用过滤器（默认值为true，可省略此配置）
authorization:
  filter:
    enabled: true

# 禁用过滤器时，Spring不会创建该Bean，自然不会注册到过滤器链
# authorization:
#   filter:
#     enabled: false

方案2：用FilterRegistrationBean手动控制注册 #

之前报错“无法构造StaticKeyAuthenticationFilter bean”，是因为你可能直接new实例而非通过Spring注入（导致@Value无法生效）。正确做法是让Spring管理过滤器Bean，再通过FilterRegistrationBean控制注册状态：

1. 保留StaticKeyAuthenticationFilter的@Component注解，确保Spring能创建Bean并注入配置值。
2. 添加配置类注册FilterRegistrationBean：

@Configuration
public class FilterConfig {

    @Autowired
    private StaticKeyAuthenticationFilter staticKeyAuthenticationFilter;

    @Value("${authorization.filter.enabled:true}")
    private boolean filterEnabled;

    @Bean
    public FilterRegistrationBean<StaticKeyAuthenticationFilter> staticKeyFilterRegistration() {
        FilterRegistrationBean<StaticKeyAuthenticationFilter> registrationBean = new FilterRegistrationBean<>();
        registrationBean.setFilter(staticKeyAuthenticationFilter);
        // 通过配置开关控制是否启用
        registrationBean.setEnabled(filterEnabled);
        // 可选：指定过滤器生效的URL模式
        // registrationBean.addUrlPatterns("/api/*");
        return registrationBean;
    }
}

方案3：将过滤器交给Spring Security管理（而非Servlet容器） #

如果该过滤器仅用于Spring Security认证流程，更合理的做法是将其从Servlet全局过滤器链移除，仅在Security过滤器链中生效，完全通过Security配置控制是否添加：

1. 去掉StaticKeyAuthenticationFilter的@Component注解，改用构造方法注入配置值（更符合Spring最佳实践）：

// 移除@Component注解
public class StaticKeyAuthenticationFilter implements Filter {

    private final String authorizationKey;

    public StaticKeyAuthenticationFilter(@Value("${authorization.key}") String authorizationKey) {
        this.authorizationKey = authorizationKey;
    }

    private final Logger logger = Logger.getLogger(StaticKeyAuthenticationFilter.class.getName());

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        // 原有逻辑保持不变
    }
}

2. 在SecurityConfig中通过配置开关动态添加过滤器：

@Configuration
@EnableWebSecurity(debug = true)
public class SecurityConfig {

    @Value("${authorization.filter.enabled:true}")
    private boolean filterEnabled;

    @Bean
    public StaticKeyAuthenticationFilter staticKeyAuthenticationFilter(@Value("${authorization.key}") String authorizationKey) {
        return new StaticKeyAuthenticationFilter(authorizationKey);
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.httpBasic(Customizer.withDefaults());
        
        // 根据配置开关决定是否添加过滤器到Security链中
        if (filterEnabled) {
            http.addFilterBefore(staticKeyAuthenticationFilter(null), UsernamePasswordAuthenticationFilter.class);
        }
        
        return http.build();
    }
}

内容的提问来源于stack exchange，提问作者Gavino