Spring Boot启动时AuthorizationFilter触发ClassCastException问题求助

启动Spring Boot应用时出现ClassCastException，错误提示：
org.springframework.security.web.access.intercept.AuthorizationFilter无法转换为javax.servlet.Filter

完整堆栈信息：

Caused by: java.lang.ClassCastException: class org.springframework.security.web.access.intercept.AuthorizationFilter cannot be cast to class javax.servlet.Filter (org.springframework.security.web.access.intercept.AuthorizationFilter and javax.servlet.Filter are in unnamed module of loader 'app')
    at org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer.configure(AuthorizeHttpRequestsConfigurer.java:73) ~[spring-security-config-5.5.2.jar:5.5.2]
    at org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer.configure(AuthorizeHttpRequestsConfigurer.java:46) ~[spring-security-config-5.5.2.jar:5.5.2]
    at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.configure(AbstractConfiguredSecurityBuilder.java:349) ~[spring-security-config-5.5.2.jar:5.5.2]
    at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.doBuild(AbstractConfiguredSecurityBuilder.java:303) ~[spring-security-config-5.5.2.jar:5.5.2]
    at org.springframework.security.config.annotation.AbstractSecurityBuilder.build(AbstractSecurityBuilder.java:38) ~[spring-security-config-5.5.2.jar:5.5.2]
    at org.springframework.boot.autoconfigure.security.servlet.SpringBootWebSecurityConfiguration$SecurityFilterChainConfiguration.defaultSecurityFilterChain(SpringBootWebSecurityConfiguration.java:61) ~[spring-boot-autoconfigure-3.1.2.jar:3.1.2]
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:na]
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) ~[na:na]
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:na]
    at java.base/java.lang.reflect.Method.invoke(Method.java:568) ~[na:na]
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:139) ~[spring-beans-6.0.11.jar:6.0.11]
    ... 37 common frames omitted

项目Maven依赖配置：

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>

        <version>3.1.2</version>
        <relativePath/>
    </parent>
    <groupId>com.example</groupId>
    <artifactId>1-project</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>1-project</name>
    <description>Demo project for Spring Boot</description>
    <properties>
        <java.version>17</java.version>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.hibernate.orm</groupId>
            <artifactId>hibernate-core</artifactId>
            <version>6.2.6.Final</version>
        </dependency>
        <dependency>
            <groupId>com.mysql</groupId>
            <artifactId>mysql-connector-j</artifactId>
            <version>8.1.0</version>
        </dependency>
        <dependency>
            <groupId>javax.validation</groupId>
            <artifactId>validation-api</artifactId>
            <version>2.0.1.Final</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
            <version>3.1.2</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
            <version>3.1.2</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
            <version>3.1.2</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <version>3.1.2</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>jakarta.validation</groupId>
            <artifactId>jakarta.validation-api</artifactId>
            <version>3.0.2</version>
        </dependency>
        <dependency>
            <groupId>xml-apis</groupId>
            <artifactId>xml-apis</artifactId>
            <version>1.3.04</version>
        </dependency>
    </dependencies>
    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>
</project>

解决思路 #

• 核心原因：Spring Boot 3.x 基于Jakarta EE 9+规范，使用jakarta.servlet.Filter接口；但堆栈中显示使用的spring-security-config是5.5.2版本，该版本属于Spring Security 5.x，依赖的是旧的javax.servlet.Filter接口，两者API不兼容导致类转换异常。

• 具体修复步骤：

  1. 移除手动指定的starter版本：Spring Boot Parent已统一管理所有starter版本，无需给spring-boot-starter-data-jpa、spring-boot-starter-security等手动指定version，避免版本冲突。
  2. 清理javax与jakarta的冲突依赖：删除javax.validation:validation-api依赖，保留jakarta.validation:jakarta.validation-api即可，避免API包冲突。
  3. 排查并升级Spring Security依赖：执行mvn dependency:tree查看依赖树，找到引入旧版本Spring Security的依赖并排除，确保所有Spring Security相关依赖为6.1.x版本（适配Spring Boot 3.1.2）。
  4. 清理重建项目：执行mvn clean install清理本地缓存，重新下载正确的依赖包。

内容的提问来源于stack exchange，提问作者CosmaPOP