SpringBoot项目部署本地Tomcat 8080端口异常问题求助

这是因为Spring Boot自动启用了Spring Security的默认安全配置，所有请求都被拦截并强制跳转到默认的/login登录页，但你未配置对应的认证提供者（AuthenticationProvider）或用户详情服务（UserDetailsService），导致登录时抛出认证错误。

1. 临时禁用Spring Security（测试用） #

如果只是想快速验证项目是否正常运行，可以直接关闭默认安全配置：

• 在启动类添加排除注解：

@SpringBootApplication(exclude = {SecurityAutoConfiguration.class, UserDetailsServiceAutoConfiguration.class})
public class YourApplication {
    public static void main(String[] args) {
        SpringApplication.run(YourApplication.class, args);
    }
}

• 或在application.properties中配置：

spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration,org.springframework.boot.autoconfigure.security.servlet.UserDetailsServiceAutoConfiguration

2. 配置合法的Spring Security认证逻辑 #

如果需要保留安全校验，必须配置认证相关组件，以下两种方式任选其一：

方式一：基于内存的简单认证（适合测试） #

创建Spring Security配置类：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .permitAll()
            );
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails testUser = User.withUsername("admin")
            .password(passwordEncoder().encode("123456"))
            .roles("ADMIN")
            .build();
        return new InMemoryUserDetailsManager(testUser);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

方式二：自定义数据库认证（生产环境推荐） #

先配置认证提供者和安全过滤链：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    private final UserDetailsService customUserDetailsService;

    public SecurityConfig(UserDetailsService customUserDetailsService) {
        this.customUserDetailsService = customUserDetailsService;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .permitAll()
            );
        return http.build();
    }

    @Bean
    public AuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(customUserDetailsService);
        authProvider.setPasswordEncoder(passwordEncoder());
        return authProvider;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

然后实现自定义UserDetailsService，从数据库查询用户信息：

import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

@Service
public class CustomUserDetailsService implements UserDetailsService {

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // 替换为你的数据库查询逻辑
        if ("admin".equals(username)) {
            return User.withUsername("admin")
                .password(new BCryptPasswordEncoder().encode("123456"))
                .roles("ADMIN")
                .build();
        } else {
            throw new UsernameNotFoundException("用户不存在: " + username);
        }
    }
}

3. 放行无需认证的资源/页面 #

如果有首页、静态文件等不需要认证的内容，可在配置类中添加放行规则：

http
    .authorizeHttpRequests(auth -> auth
        .requestMatchers("/", "/home", "/css/**", "/js/**").permitAll()
        .anyRequest().authenticated()
    )

• 若完全不需要安全功能，直接移除项目依赖中的spring-boot-starter-security；
• 部署到Tomcat时，注意项目上下文路径，若不是根路径，访问需加上路径前缀（如localhost:8080/your-project/users）。

内容的提问来源于stack exchange，提问作者Dinesh_DK