Spring Security在AWS Serverless Spring Native应用中失效问题排查

我参考pet-store-native（Spring Boot + GraalVM + AWS Serverless应用）示例，给部署在AWS Lambda上的Spring Native应用添加Spring Security过滤器，但未达预期效果，具体异常如下：

异常表现 #

• authorizeHttpRequests配置未生效：要求/pets端点需认证，但实际无需认证即可访问
• 自定义过滤器执行异常：部分过滤器运行在Security Filter Chain之外，部分运行在链内

相关代码 #

SecurityConfiguration类 #

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
            .csrf(csrf -> csrf.disable())
            .cors(cors -> cors.disable())
            .authorizeHttpRequests(auth -> {
                auth
                        .requestMatchers("/pets").authenticated()
                        .anyRequest().permitAll();
                // .anyRequest().permitAll();
            })
            .addFilterAfter(outsideFilter, CorsFilter.class)
            .addFilterAfter(simpleFilter, UsernamePasswordAuthenticationFilter.class)
            .sessionManagement(
                    sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS).sessionFixation().none());

    return http.build();
}

OutsideProjectFilter类（继承OncePerRequestFilter） #

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
        throws ServletException, IOException {
        System.out.println("Running a filter outisde the current project.");

        filterChain.doFilter(request, response);
}

SimpleFilter类（继承OncePerRequestFilter） #

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
        throws ServletException, IOException {
    System.out.println("Running a simple filter");

    filterChain.doFilter(request, response);
}

DemoApplication类 #

@SpringBootApplication(scanBasePackages = {"com.sample.filters","com.amazonaws.serverless.sample.springboot3"})
public class DemoApplication {

补充信息 #

• 过滤器执行链异常日志：日志追踪显示过滤器执行顺序不符合配置预期，部分自定义过滤器在Security Filter Chain外部执行
• 测试验证：通过curl请求/pets端点，未携带任何认证信息仍能成功获取响应
• 完整代码实现：包含上述所有代码的完整项目

内容的提问来源于stack exchange，提问作者Aniket Saini