Spring Boot 3.2.0中oauth2ResourceServer等方法废弃致应用崩溃求助

我的Spring Boot 3.2.0应用遇到以下问题：

• IDE提示oauth2ResourceServer()、jwt()、cors()和csrf()方法已被废弃并标记为待移除，尽管网上查到这些是旧版常用实现方式
• 运行应用时直接崩溃，查阅多篇文章仍未解决

原安全配置代码 #

package com.mtcompany.ecommerceshop.config;

import com.okta.spring.boot.oauth.Okta;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.accept.ContentNegotiationStrategy;
import org.springframework.web.accept.HeaderContentNegotiationStrategy;

@Configuration
public class SecurityConfiguration {

    @Bean
    protected SecurityFilterChain filterChain(HttpSecurity http) throws Exception {

        http.authorizeHttpRequests(requests ->
                        requests
                                .requestMatchers("/api/orders/**")
                                .authenticated()
                                .anyRequest().permitAll())
                .oauth2ResourceServer()
                .jwt();

        http.cors();
        
        http.setSharedObject(ContentNegotiationStrategy.class, new
                HeaderContentNegotiationStrategy());

        Okta.configureResourceServer401ResponseBody(http);

        http.csrf().disable();

        return http.build();
    }

}

IDE提示信息 #

'oauth2ResourceServer()' is deprecated and marked for removal 
'jwt()' is deprecated and marked for removal 
'cors()' is deprecated and marked for removal
'csrf()' is deprecated and marked for removal

项目pom.xml #

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.2.0</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.mtcompany</groupId>
    <artifactId>ecommerce-shop</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>ecommerce-shop</name>
    <description>Demo project for Spring Boot</description>
    <properties>
        <java.version>21</java.version>
    </properties>
    <dependencies>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springdoc</groupId>
            <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
            <version>2.0.0</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-validation</artifactId>
        </dependency>

        <dependency>
            <groupId>com.okta.spring</groupId>
            <artifactId>okta-spring-boot-starter</artifactId>
            <version>3.0.2</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-rest</artifactId>
        </dependency>

        <dependency>
            <groupId>com.mysql</groupId>
            <artifactId>mysql-connector-j</artifactId>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <configuration>
                    <excludes>
                        <exclude>
                            <groupId>org.projectlombok</groupId>
                            <artifactId>lombok</artifactId>
                        </exclude>
                    </excludes>
                </configuration>
            </plugin>
        </plugins>
    </build>

</project>

Spring Boot 3.2.x依赖的Spring Security 6.2+对HttpSecurity配置API做了重大调整，废弃了原有链式调用方法，改用lambda配置风格。以下是修复步骤：

1. 更新安全配置类 #

替换原SecurityConfiguration为以下代码：

package com.mtcompany.ecommerceshop.config;

import com.okta.spring.boot.oauth.Okta;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.accept.ContentNegotiationStrategy;
import org.springframework.web.accept.HeaderContentNegotiationStrategy;

@Configuration
public class SecurityConfiguration {

    @Bean
    protected SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        // 配置请求授权规则
        http.authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/orders/**").authenticated()
                .anyRequest().permitAll());

        // 配置OAuth2资源服务器（JWT）
        http.oauth2ResourceServer(oauth2 -> oauth2.jwt(jwt -> {}));

        // 启用CORS（可在lambda内添加自定义规则）
        http.cors(cors -> {});

        // 设置内容协商策略
        http.setSharedObject(ContentNegotiationStrategy.class, new HeaderContentNegotiationStrategy());

        // 配置Okta自定义401响应体
        Okta.configureResourceServer401ResponseBody(http);

        // 禁用CSRF
        http.csrf(AbstractHttpConfigurer::disable);

        return http.build();
    }
}

2. 关键修改说明 #

• oauth2ResourceServer() & jwt()：原链式调用http.oauth2ResourceServer().jwt()改为lambda形式http.oauth2ResourceServer(oauth2 -> oauth2.jwt(...))，符合Spring Security 6.2+的新API规范
• cors()：替换为cors(cors -> {})，如果需要自定义CORS配置，可在lambda中添加cors.configurationSource(corsConfigurationSource())等逻辑
• csrf().disable()：替换为csrf(AbstractHttpConfigurer::disable)，使用静态方法引用简化禁用逻辑

3. 依赖兼容性确认 #

你使用的okta-spring-boot-starter:3.0.2完全适配Spring Boot 3.x版本，无需调整。若后续遇到Okta相关问题，可考虑升级至最新稳定版。

内容的提问来源于stack exchange，提问作者mtt