Spring Security配置报错：无法解析WebSecurityConfigurerAdapter及重写问题

问题原因 #

你使用的Spring Boot 3.2.1对应Spring Security 6.x版本，该版本已移除WebSecurityConfigurerAdapter类——这个类在Spring Security 5.7+就被标记为废弃，6.x正式删除，因此编译器找不到该类，进而引发继承和方法重写的错误。

解决方案 #

改用Spring Security 6.x推荐的基于Bean的配置方式，替代原有的继承WebSecurityConfigurerAdapter的写法：

修改后的SecurityConfig代码 #

package com.shubham.dev.discoveryserver.config;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Value("${app.eureka.username}")
    private String username;
    @Value("${app.eureka.password}")
    private String password;

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.csrf(csrf -> csrf.disable())
                .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
                .httpBasic(Customizer.withDefaults());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withUsername(username)
                .password(password)
                .authorities("USER")
                .build();
        return new InMemoryUserDetailsManager(user);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return NoOpPasswordEncoder.getInstance();
    }
}

关键改动说明 #

• 移除对WebSecurityConfigurerAdapter的继承，添加@EnableWebSecurity注解启用Spring Security配置
• 用SecurityFilterChain Bean替代原有的configure(HttpSecurity)方法，处理HTTP安全规则
• 用UserDetailsService Bean替代原有的configure(AuthenticationManagerBuilder)方法，配置内存用户
• 显式声明PasswordEncoder Bean（注意：NoOpPasswordEncoder仅适合测试场景，生产环境建议使用BCrypt等强加密方式）

依赖说明 #

你的pom.xml依赖无需调整，spring-boot-starter-security会自动适配Spring Boot 3.2.1对应的Spring Security版本。

内容的提问来源于stack exchange，提问作者Rex