Spring Boot Security登录日志入库遇NullPointerException问题求助

核心原因 #

空指针的直接原因是AuthenticationFailureHandler、AuthenticationSuccessHandler实例中的SessionService依赖未被正确注入，导致调用errorSession等方法时对象为null。

具体修复步骤 #

1. 确保Handler类被Spring容器管理 #

检查你的AuthenticationFailureHandler和AuthenticationSuccessHandler实现类是否添加了Spring组件注解（如@Component），让Spring扫描并创建实例：

@Component
public class CustomAuthFailureHandler implements AuthenticationFailureHandler {
    private final SessionService sessionService;

    // 构造方法注入（推荐方式）
    public CustomAuthFailureHandler(SessionService sessionService) {
        this.sessionService = sessionService;
    }

    @Override
    public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, AuthenticationException exception) throws IOException, ServletException {
        String ip = request.getRemoteAddr();
        sessionService.errorSession(ip);
        // 其他失败逻辑
    }
}

2. 禁止在WebSecurityConfig中手动new Handler实例 #

不要直接new CustomAuthFailureHandler()，否则Spring无法注入内部依赖。正确做法是通过构造注入将Handler引入配置类：

@Configuration
@EnableWebSecurity
public class WebSecurityConfiguration {
    private final CustomAuthFailureHandler authFailureHandler;
    private final CustomAuthSuccessHandler authSuccessHandler;

    public WebSecurityConfiguration(CustomAuthFailureHandler authFailureHandler, CustomAuthSuccessHandler authSuccessHandler) {
        this.authFailureHandler = authFailureHandler;
        this.authSuccessHandler = authSuccessHandler;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .formLogin(form -> form
                .failureHandler(authFailureHandler)
                .successHandler(authSuccessHandler)
                // 其他登录配置
            );
        return http.build();
    }
}

3. 确认SessionService的注解正确 #

检查SessionService是否添加@Service注解，确保Spring能扫描并创建其实例：

@Service
public class SessionService {
    private final SessionRepository sessionRepository;

    public SessionService(SessionRepository sessionRepository) {
        this.sessionRepository = sessionRepository;
    }

    public void errorSession(String ip) {
        Session session = new Session();
        session.setIp(ip);
        session.setType("FAILURE");
        session.setDate(LocalDateTime.now());
        sessionRepository.save(session);
    }

    // 登录成功日志方法
}

4. 检查组件扫描范围 #

如果Handler、Service类不在主启动类所在包的子包下，需在主启动类添加@ComponentScan指定扫描范围：

@SpringBootApplication
@ComponentScan(basePackages = {"com.user.handler", "com.user.service", "com.user.repository"})
public class YourApplication {
    public static void main(String[] args) {
        SpringApplication.run(YourApplication.class, args);
    }
}

5. 优先使用构造方法注入 #

避免使用@Autowired字段注入，改用构造方法注入可避免循环依赖和注入时机问题，同时让依赖关系更清晰。

验证步骤 #

1. 重启应用，确认启动时无Bean创建失败异常
2. 测试登录失败/成功场景，检查数据库是否生成对应记录
3. 若问题仍存在，开启Spring Debug日志，查看Bean创建与注入过程，定位异常环节

内容的提问来源于stack exchange，提问作者Djorkaeff