Spring Boot网关SecurityFilterChain缺失HttpSecurity Bean问题求助

问题根源 #

1. 技术栈不匹配：Spring Cloud Gateway基于WebFlux反应式架构，你却使用了Servlet栈的HttpSecurity和SecurityFilterChain，反应式环境中不存在这类Bean，导致依赖注入失败。
2. 依赖冗余冲突：pom.xml中重复引入spring-boot-starter-oauth2-resource-server，还额外添加了不必要的spring-security-oauth2-resource-server单独依赖。
3. 注解未生效：已导入@EnableWebFluxSecurity但未在配置类上启用，无法触发反应式安全配置的自动装配。

解决方案 #

1. 修正SecurityConfig配置类 #

改用WebFlux对应的反应式安全API，替换Servlet栈的类与方法：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.web.server.SecurityWebFilterChain;

@Configuration
@EnableWebFluxSecurity // 启用WebFlux安全配置
public class SecurityConfig {

    @Bean
    public SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
        // 配置OAuth2资源服务器（JWKS端点）
        http.oauth2ResourceServer(server -> 
            server.jwt(jwt -> jwt.jwkSetUri("http://localhost:8080/oauth2/jwks"))
        );
        // 配置请求权限规则
        http.authorizeExchange(exchanges -> exchanges
                .pathMatchers("/user/auth").permitAll()
                .anyExchange().authenticated()
        );
        return http.build();
    }
}

2. 清理pom.xml依赖 #

移除重复依赖，保持版本与Spring Boot/Spring Cloud父pom一致：

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-actuator</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-gateway</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-api</artifactId>
        <version>0.11.5</version>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-impl</artifactId>
        <version>0.11.5</version>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-jackson</artifactId>
        <version>0.11.5</version>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-test</artifactId>
        <scope>test</scope>
    </dependency>
    <!-- 仅保留一个OAuth2资源服务器Starter，使用父pom管理版本 -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-circuitbreaker-reactor-resilience4j</artifactId>
    </dependency>
    <dependency>
        <groupId>org.projectlombok</groupId>
        <artifactId>lombok</artifactId>
        <optional>true</optional>
    </dependency>
    <dependency>
        <groupId>io.projectreactor</groupId>
        <artifactId>reactor-test</artifactId>
        <scope>test</scope>
    </dependency>
</dependencies>

关键说明 #

• ServerHttpSecurity是WebFlux环境下的安全配置入口，替代Servlet栈的HttpSecurity，会由@EnableWebFluxSecurity自动装配为可注入的Bean。
• 清理重复依赖可避免版本冲突，同时利用Spring Boot父pom的版本管理机制，减少手动指定版本的冗余。

内容的提问来源于stack exchange，提问作者Bulbul Ahmed