Spring项目报错：无法找到HttpSecurity类型Bean，求排查方案

问题 #

项目启动时提示SecurityConfiguration类的securityFilterChain方法需要HttpSecurity类型Bean，但该Bean不存在。已导入全部依赖，项目从老师GitHub仓库fork，老师那边可正常运行。尝试添加@EnableWebSecurity、给HttpSecurity加@Autowired均未解决，添加@EnableWebSecurity还引发其他错误。

报错信息 #

Parameter 0 of method securityFilterChain in uz.smartup.academy.hibernateadvanced.config.SecurityConfiguration required a bean of type 'org.springframework.security.config.annotation.web.builders.HttpSecurity' that could not be found.

Action:

Consider defining a bean of type 'org.springframework.security.config.annotation.web.builders.HttpSecurity' in your configuration.

现有代码 #

package uz.smartup.academy.hibernateadvanced.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.provisioning.JdbcUserDetailsManager;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.annotation.web.configurers.LogoutConfigurer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.provisioning.UserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

import javax.sql.DataSource;

@Configuration
//@EnableWebSecurity
public class SecurityConfiguration {

    @Bean
    public UserDetailsManager userDetailsManager(DataSource dataSource) {
        JdbcUserDetailsManager detailsManager = new JdbcUserDetailsManager(dataSource);
    
        detailsManager.setUsersByUsernameQuery("Select username, password, enabled FROM user WHERE username = ?");
        detailsManager.setAuthoritiesByUsernameQuery("Select username, role WHERE username = ?");
    
        return detailsManager;
    }
    
    
    @Bean
    public SecurityFilterChain securityFilterChain( HttpSecurity httpSecurity) throws Exception {
        httpSecurity.authorizeHttpRequests(authRegistry ->
                        authRegistry
                                .requestMatchers(HttpMethod.GET,  "/web/instructors", "/web/instructors/*").hasAnyRole("ADMIN", "MANAGER")
                                .requestMatchers(HttpMethod.POST, "/web/instructors/*").hasAnyRole("ADMIN", "MANAGER")
                                .requestMatchers(HttpMethod.PUT, "/web/instructors/*").hasAnyRole("ADMIN", "MANAGER")
                                .requestMatchers(HttpMethod.DELETE, "/web/instructors/*").hasRole("ADMIN")
                                .requestMatchers(HttpMethod.GET, "/web/students/*").hasAnyRole("ADMIN", "MANAGER", "INSTRUCTOR")
                                .requestMatchers(HttpMethod.POST, "/web/students/*").hasAnyRole("ADMIN", "MANAGER", "INSTRUCTOR")
                                .requestMatchers(HttpMethod.PUT, "/web/students/*").hasAnyRole("ADMIN", "MANAGER", "INSTRUCTOR")
                                .requestMatchers(HttpMethod.DELETE, "/web/students/*").hasAnyRole("ADMIN", "MANAGER")
                                .requestMatchers(HttpMethod.GET, "/web/courses/*").hasAnyRole("ADMIN", "MANAGER", "INSTRUCTOR", "STUDENT")
                                .requestMatchers(HttpMethod.PUT, "/web/courses/*").hasAnyRole("INSTRUCTOR")
                                .requestMatchers(HttpMethod.DELETE, "/web/courses/*").hasAnyRole("INSTRUCTOR")
                                .requestMatchers(HttpMethod.GET, "/web/reviews/*").hasAnyRole("ADMIN", "MANAGER", "INSTRUCTOR", "STUDENT")
                                .requestMatchers(HttpMethod.DELETE, "/web/reviews/*").hasAnyRole("STUDENT")
                                .requestMatchers("/access-denied").permitAll()
                                .anyRequest().authenticated())
                .exceptionHandling(configurer ->
                        configurer.accessDeniedPage("/access-denied"))
                .formLogin(form ->
                        form.loginPage("/login")
                                .loginProcessingUrl("/authenticate")
                                .permitAll())
                .logout(LogoutConfigurer::permitAll);
    
        httpSecurity.csrf(AbstractHttpConfigurer::disable);
        httpSecurity.httpBasic(Customizer.withDefaults());
    
        return httpSecurity.build();
    }

}

解决方法 #

1. 修正SecurityFilterChain方法的参数使用 #

Spring Security 5.7+版本中，HttpSecurity不需要额外注入，框架会自动为securityFilterChain方法提供该实例。确保方法参数不需要加@Autowired，直接保留即可：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    // 原有配置逻辑不变
    http.authorizeHttpRequests(authRegistry ->
                    authRegistry
                            .requestMatchers(HttpMethod.GET,  "/web/instructors", "/web/instructors/*").hasAnyRole("ADMIN", "MANAGER")
                            // 其余权限规则保持不变
                            .anyRequest().authenticated())
            .exceptionHandling(configurer ->
                    configurer.accessDeniedPage("/access-denied"))
            .formLogin(form ->
                    form.loginPage("/login")
                            .loginProcessingUrl("/authenticate")
                            .permitAll())
            .logout(LogoutConfigurer::permitAll);

    http.csrf(AbstractHttpConfigurer::disable);
    http.httpBasic(Customizer.withDefaults());

    return http.build();
}

2. 对齐项目依赖版本 #

检查pom.xml（Maven）或build.gradle（Gradle），确保Spring Boot和Spring Security的版本与老师仓库完全一致。版本不匹配会导致自动配置逻辑差异，比如Spring Boot 2.x和3.x的Security配置逻辑有明显区别。

3. 移除多余注解 #

• 不要给HttpSecurity参数加@Autowired，框架会自动处理实例注入
• 不要手动添加@EnableWebSecurity，Spring Boot自动配置会在检测到Security依赖时启用Web安全，手动添加可能引发重复配置错误

4. 清理缓存并重新构建 #

执行以下操作确保依赖正确加载：

• Maven：运行mvn clean install
• Gradle：运行gradle clean build
• 重启IDE，避免缓存导致的依赖加载异常

内容的提问来源于stack exchange，提问作者abdullakh mirfayziev