SpringBoot 2.7升级至3.1.1：WebSecurityConfigurerAdapter等API弃用问题求助

1. 替换弃用的 WebSecurityConfigurerAdapter，使用 SecurityFilterChain #

Spring Security 6.x（Spring Boot 3.x 配套版本）弃用了WebSecurityConfigurerAdapter，改用通过@Bean定义SecurityFilterChain的方式配置安全规则。修改后的OpaqueSecurityConfig如下：

package ec.edu.espe.generalapi.Config.security;

import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
import org.springframework.boot.web.client.RestTemplateBuilder;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class OpaqueSecurityConfig {

    private final OpaqueTokenIntrospector customTokenIntrospector;

    // 构造注入自定义令牌解析器
    public OpaqueSecurityConfig(OpaqueTokenIntrospector customTokenIntrospector) {
        this.customTokenIntrospector = customTokenIntrospector;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                // 禁用CSRF（REST API场景通常不需要）
                .csrf(csrf -> csrf.disable())
                // 配置CORS，Spring Boot会自动加载全局CORS配置
                .cors(cors -> cors.configure(http))
                // 无状态会话（REST API特性）
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                // 授权规则配置
                .authorizeHttpRequests(authz -> authz
                        // 允许GET请求访问公开接口和文档
                        .requestMatchers(HttpMethod.GET, 
                                "/public/**", 
                                "/v3/api-docs/**", 
                                "/swagger-ui/**", 
                                "/swagger-ui.html", 
                                "/apiGeneral-docs/**", 
                                "/swagger-ui-GeneralApi/**", 
                                "/swagger-ui-GeneralApi.html/**")
                        .permitAll()
                        // 允许POST请求访问公开接口
                        .requestMatchers(HttpMethod.POST, "/public/**")
                        .permitAll()
                        // 其余所有请求需认证
                        .anyRequest().authenticated())
                // 配置OAuth2资源服务器，使用自定义不透明令牌解析器
                .oauth2ResourceServer(oauth2 -> oauth2
                        .opaqueToken(token -> token.introspector(customTokenIntrospector)));

        return http.build();
    }

    @Bean
    OpaqueTokenIntrospector tokenIntrospector(RestTemplateBuilder builder, OAuth2ResourceServerProperties resourceServerProps) {
        return new CustomOpaqueTokenIntrospector(builder, resourceServerProps);
    }
}

关键变更点：

• 移除extends WebSecurityConfigurerAdapter，添加@EnableWebSecurity注解
• 用SecurityFilterChain Bean替代configure(HttpSecurity)方法
• authorizeRequests替换为authorizeHttpRequests
• antMatchers替换为requestMatchers
• 显式配置会话为无状态（REST API推荐）
• 配置oauth2ResourceServer时，通过opaqueToken(token -> token.introspector(...))指定自定义令牌解析器

2. 调整 CustomOpaqueTokenIntrospector 构造函数可见性 #

原代码中构造函数是包私有，Spring无法正常实例化该Bean，需改为public：

package ec.edu.espe.generalapi.Config.security;

import org.springframework.boot.autoconfigure.security.oauth2.resource.OAuth2ResourceServerProperties;
import org.springframework.boot.web.client.RestTemplateBuilder;
import org.springframework.security.oauth2.core.OAuth2AuthenticatedPrincipal;
import org.springframework.security.oauth2.server.resource.introspection.NimbusOpaqueTokenIntrospector;
import org.springframework.security.oauth2.server.resource.introspection.OpaqueTokenIntrospector;
import org.springframework.web.client.RestOperations;

import java.time.Duration;

public class CustomOpaqueTokenIntrospector implements OpaqueTokenIntrospector {
    private final OAuth2ResourceServerProperties.Opaquetoken opaqueTokenProps;
    private final RestTemplateBuilder builder;

    // 修改为public构造函数
    public CustomOpaqueTokenIntrospector(RestTemplateBuilder builder, OAuth2ResourceServerProperties resourceServerProps) {
        this.opaqueTokenProps = resourceServerProps.getOpaquetoken();
        this.builder = builder;
    }

    @Override
    public OAuth2AuthenticatedPrincipal introspect(String token) {
        RestOperations restOperations = builder
                .defaultHeader("Authorization", "Bearer " + token)
                .setConnectTimeout(Duration.ofSeconds(60))
                .setReadTimeout(Duration.ofSeconds(60))
                .build();
        return new NimbusOpaqueTokenIntrospector(opaqueTokenProps.getIntrospectionUri(), restOperations).introspect(token);
    }
}

3. 修正 build.gradle 依赖版本问题 #

原依赖中存在版本不匹配的问题，需统一由Spring Boot的依赖管理插件控制版本：

plugins {
    id 'java'
    id 'org.springframework.boot' version '3.1.3'
    id 'io.spring.dependency-management' version '1.1.3'
}

group = 'example'
version = '0.0.1-SNAPSHOT'

java {
    sourceCompatibility = '17'
}

repositories {
    mavenCentral()
}

dependencies {
    implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
    implementation 'org.springframework.boot:spring-boot-starter-web'
    // 移除手动指定的版本，由Spring Boot依赖管理自动匹配
    implementation 'org.springframework.boot:spring-boot-starter-oauth2-resource-server'
    // 移除不必要的gradle-plugin依赖（plugins中已声明）
    compileOnly 'org.projectlombok:lombok'
    // Spring Boot 3.x 需使用springdoc v2.x版本，v1.x不兼容
    implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:2.2.0'
    implementation 'org.springdoc:springdoc-openapi-starter-webmvc-api:2.2.0'
    implementation 'org.postgresql:postgresql'
    // Nimbus SDK版本由Spring Security自动管理，可移除手动指定
    implementation 'org.springframework.boot:spring-boot-starter-actuator'
    runtimeOnly 'com.oracle.database.jdbc:ojdbc8'
    annotationProcessor 'org.projectlombok:lombok'
    testImplementation 'org.springframework.boot:spring-boot-starter-test'
}

tasks.named('test') {
    useJUnitPlatform()
}

关键依赖修正：

• 移除spring-boot-starter-oauth2-resource-server的手动版本号，让依赖管理插件匹配Spring Boot 3.1.3的对应版本
• 移除spring-boot-gradle-plugin的implementation依赖（该插件仅需在plugins块声明）
• 升级springdoc到v2.x版本（v1.x不兼容Spring Boot 3.x）
• 移除com.nimbusds:oauth2-oidc-sdk的手动版本，Spring Security会自动引入兼容版本
• 移除spring-boot-starter-actuator的手动版本号

4. 补充说明 #

• 确保application.properties或application.yml中配置了OAuth2资源服务器的不透明令牌相关属性，例如：

  spring.security.oauth2.resourceserver.opaquetoken.introspection-uri=https://your-auth-server/introspect
  # 如果需要客户端认证，添加以下配置
  # spring.security.oauth2.resourceserver.opaquetoken.client-id=your-client-id
  # spring.security.oauth2.resourceserver.opaquetoken.client-secret=your-client-secret
  

• 若需要自定义CORS配置，可添加@Bean CorsConfigurationSource来定义全局CORS规则，Spring Security会自动应用该配置。

内容的提问来源于stack exchange，提问作者Kenny Cruz