Spring Boot Security：User.builder()方法未定义问题求助

核心原因 #

你代码里导入的是自己项目的com.model.User类，而Spring Security提供的带builder()方法的User类是org.springframework.security.core.userdetails.User，这是导致方法找不到的直接原因。

解决步骤 #

1. 修正导入语句 #

把配置类里的：

import com.model.User;

替换为：

import org.springframework.security.core.userdetails.User;

如果项目中需要同时使用自定义的User类和Spring Security的User类，直接用全限定名调用Spring Security的User即可，比如：

UserDetails user = org.springframework.security.core.userdetails.User.builder()
    // ... 配置内容
    .build();

2. 修复密码未加密问题 #

当前代码里直接明文设置密码会触发Spring Security的密码格式校验错误，需要用你定义的PasswordEncoder加密后再设置：

@Bean
public UserDetailsService users(PasswordEncoder passwordEncoder) {
    UserDetails user = User.builder()
        .username("user")
        .password(passwordEncoder.encode("pass")) // 加密密码
        .roles("USER")
        .build();
    return new InMemoryUserDetailsManager(user);
}

3. 优化SecurityFilterChain的过时API #

你代码里的authorizeRequests()已经废弃，建议替换为authorizeHttpRequests()，同时去掉不必要的SuppressWarnings注解：

@Bean
public SecurityFilterChain configure(HttpSecurity http) throws Exception {
    http
        .csrf(csrf -> csrf.disable())
        .authorizeHttpRequests(auth -> auth
            .requestMatchers(HttpMethod.GET).permitAll()
            .anyRequest().authenticated()
        )
        .httpBasic(Customizer.withDefaults());
    return http.build();
}

修改后的完整配置代码 #

package com.configuration;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain configure(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(auth -> auth
                .requestMatchers(HttpMethod.GET).permitAll()
                .anyRequest().authenticated()
            )
            .httpBasic(Customizer.withDefaults());
        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public UserDetailsService users(PasswordEncoder passwordEncoder) {
        UserDetails user = User.builder()
            .username("user")
            .password(passwordEncoder.encode("pass"))
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

内容的提问来源于stack exchange，提问作者Anonymous