Spring Security 6如何自定义ServerFormLoginAuthenticationConverter？

当Spring Security WebFlux的ServerHttpSecurity.FormLoginSpec硬编码了ServerFormLoginAuthenticationConverter，且无法直接访问默认生成的AuthenticationWebFilter时，可以通过以下两种方式替换自定义转换器：

方法一：手动构建并替换认证过滤器 #

跳过默认表单登录配置的过滤器生成逻辑，手动创建带自定义转换器的AuthenticationWebFilter，替换默认过滤器：

// 1. 先配置表单登录的基础组件（入口点、处理器等）
http.formLogin(form -> form
        .authenticationEntryPoint(yourAuthenticationEntryPoint)
        .authenticationSuccessHandler(yourSuccessHandler)
        .authenticationFailureHandler(yourFailureHandler)
        .securityContextRepository(yourSecurityContextRepo)
);

// 2. 移除默认生成的FORM_LOGIN过滤器
http.getExchange().getFilters().removeIf(filter -> {
    if (!(filter instanceof AuthenticationWebFilter)) {
        return false;
    }
    AuthenticationWebFilter authFilter = (AuthenticationWebFilter) filter;
    // 判断是否是表单登录的过滤器（匹配默认登录路径）
    return authFilter.getRequiresAuthenticationMatcher() instanceof PathPatternParserServerWebExchangeMatcher
            && "/login".equals(((PathPatternParserServerWebExchangeMatcher) authFilter.getRequiresAuthenticationMatcher()).getPattern());
});

// 3. 手动构建带自定义转换器的认证过滤器
AuthenticationWebFilter customAuthFilter = new AuthenticationWebFilter(yourAuthenticationManager);
customAuthFilter.setRequiresAuthenticationMatcher(ServerHttpSecurity.FormLoginSpec.DEFAULT_LOGIN_PAGE_MATCHER);
customAuthFilter.setAuthenticationFailureHandler(yourFailureHandler);
// 设置自定义转换器
customAuthFilter.setAuthenticationConverter(new YourCustomServerFormLoginAuthenticationConverter());
customAuthFilter.setAuthenticationSuccessHandler(yourSuccessHandler);
customAuthFilter.setSecurityContextRepository(yourSecurityContextRepo);

// 4. 将自定义过滤器添加到FORM_LOGIN的顺序位置
http.addFilterAt(customAuthFilter, SecurityWebFiltersOrder.FORM_LOGIN);

方法二：扩展FormLoginConfigurer重写配置逻辑 #

通过扩展Spring Security的配置类，在配置阶段替换默认转换器：

// 自定义表单登录配置类，扩展默认的FormLoginConfigurer
public class CustomFormLoginConfigurer extends ServerHttpSecurity.FormLoginConfigurer {
    private AuthenticationConverter customConverter;

    // 提供设置自定义转换器的方法
    public CustomFormLoginConfigurer withCustomConverter(AuthenticationConverter converter) {
        this.customConverter = converter;
        return this;
    }

    @Override
    public void configure(ServerHttpSecurity http) {
        // 先执行默认配置逻辑，生成过滤器
        super.configure(http);
        // 找到默认生成的AuthenticationWebFilter并替换转换器
        List<WebFilter> filters = http.getExchange().getFilters();
        for (WebFilter filter : filters) {
            if (filter instanceof AuthenticationWebFilter) {
                AuthenticationWebFilter authFilter = (AuthenticationWebFilter) filter;
                if (customConverter != null) {
                    authFilter.setAuthenticationConverter(customConverter);
                }
                break;
            }
        }
    }
}

// 使用自定义配置类
http.apply(new CustomFormLoginConfigurer())
        .withCustomConverter(new YourCustomServerFormLoginAuthenticationConverter())
        .authenticationSuccessHandler(yourSuccessHandler)
        .authenticationFailureHandler(yourFailureHandler)
        // 其他表单登录相关配置...

核心思路 #

默认的FormLoginSpec在生成AuthenticationWebFilter时直接硬编码实例化了ServerFormLoginAuthenticationConverter，且未暴露修改入口。上述两种方法本质都是替换或修改已生成的AuthenticationWebFilter，让其使用自定义的转换器实现。

内容的提问来源于stack exchange，提问作者tinashe.chipomho