Spring Security配置报错：无法自动装配HttpSecurity Bean求解决方案

核心问题 #

1. 版本不兼容：你使用的Spring Boot 2.2.5对应Spring Security 5.2.x，该版本不支持将HttpSecurity作为参数注入到SecurityFilterChain Bean方法中（这种函数式配置是Spring Security 5.4+才引入的）。
2. 依赖配置错误：spring-boot-starter-security依赖手动指定了LATEST版本，且标签语法存在错误（多了一个>），导致依赖冲突或加载异常。
3. HttpSecurity的误解：HttpSecurity并非Spring容器中的可直接注入Bean，它由Spring Security内部构建，不能手动声明。

解决方案 #

方案1：适配当前Spring Boot 2.2.5版本（使用WebSecurityConfigurerAdapter） #

虽然WebSecurityConfigurerAdapter已被标记为废弃，但在Spring Security 5.2中仍是标准配置方式，修改代码如下：

package com.company.project.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .authorizeRequests()
                .anyRequest().authenticated()
                .and()
                .httpBasic()
                .and()
                .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }

    // 暴露AuthenticationManager Bean供后续JWT使用
    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
        manager.createUser(User.withUsername("user")
                .password(passwordEncoder().encode("password"))
                .roles("USER")
                .build());
        return manager;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

方案2：升级Spring Boot版本（推荐，使用SecurityFilterChain） #

将Spring Boot版本升级到2.3+（比如稳定版2.7.x），适配Spring Security 5.4+的函数式配置：

1. 修正pom.xml的parent版本：

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>2.7.18</version> <!-- 替换为稳定版 -->
    <relativePath/>
</parent>

2. 修正spring-boot-starter-security依赖（移除手动版本，由parent管理）：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

3. 修改Security配置类：

package com.company.project.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig {

    @Bean
    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
                .csrf().disable()
                .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
                .httpBasic()
                .and()
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .build();
    }

    // 手动获取AuthenticationManager
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
        manager.createUser(User.withUsername("user")
                .password(passwordEncoder().encode("password"))
                .roles("USER")
                .build());
        return manager;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

关键说明 #

• HttpSecurity不能手动声明为Bean，它由Spring Security内部根据配置构建，只能通过官方提供的配置入口（如上述两种方案中的方式）进行配置。
• 始终保持Spring Boot与Spring Security版本匹配，避免手动指定Security依赖版本，由Spring Boot parent统一管理版本可减少冲突。

内容的提问来源于stack exchange，提问作者HexVex