Spring Security多表单登录异常：第二个formLogin()不支持POST请求

你的问题根源在于多个SecurityFilterChain的匹配逻辑冲突：Spring Security会按Bean的加载顺序（默认按方法名字典序，filterChain比filterChain2先执行）处理请求，第一个FilterChain中的.anyRequest().permitAll()会匹配所有请求，包括/Trainer/LogIn的POST登录请求。但第一个FilterChain并没有配置该路径的登录处理逻辑，导致Spring MVC找不到对应的POST处理器，最终提示"POST方法不支持"。

下面提供两种可行的解决方案：

方案一：为每个FilterChain指定专属匹配路径 #

通过securityMatcher()让每个FilterChain只处理对应前缀的请求，避免互相干扰：

@Configuration
@EnableWebSecurity
public class WebSecurityConfig {

    private final AppUserService trainerAppUserService;
    private final AppUserService vereinAppUserService;
    private final BCryptPasswordEncoder bCryptPasswordEncoder;

    public WebSecurityConfig(
            @Qualifier("trainer") AppUserService trainerAppUserService,
            @Qualifier("verein") AppUserService vereinAppUserService, BCryptPasswordEncoder bCryptPasswordEncoder) {
        this.trainerAppUserService = trainerAppUserService;
        this.vereinAppUserService = vereinAppUserService;
        this.bCryptPasswordEncoder = bCryptPasswordEncoder;
    }

    // 处理/Verein路径的FilterChain
    @Bean
    public SecurityFilterChain vereinSecurityFilterChain(HttpSecurity http) throws Exception {
        // 仅匹配/Verein开头的请求
        http.securityMatcher("/Verein/**");

        AuthenticationManagerBuilder authBuilder = http.getSharedObject(AuthenticationManagerBuilder.class);
        authBuilder.authenticationProvider(vereinDaoAuthenticationProvider());

        http.csrf().disable()
            .httpBasic().disable()
            .authorizeRequests(auth -> auth
                .antMatchers("/Verein/**/*.*").authenticated()
                .anyRequest().permitAll()
            )
            .formLogin(form -> form
                .usernameParameter("email")
                .passwordParameter("password")
                .loginPage("/Verein/LogIn")
                .loginProcessingUrl("/Verein/LogIn")
                .successHandler((req, res, auth) -> res.sendRedirect("/Verein/Homepage"))
                .permitAll()
            )
            .logout(logout -> logout
                .logoutUrl("/Verein/LogOut")
                .logoutSuccessUrl("/Verein/LogIn")
                .deleteCookies("JSESSIONID")
                .permitAll()
            );

        return http.build();
    }

    // 处理/Trainer路径的FilterChain
    @Bean
    public SecurityFilterChain trainerSecurityFilterChain(HttpSecurity http) throws Exception {
        // 仅匹配/Trainer开头的请求
        http.securityMatcher("/Trainer/**");

        AuthenticationManagerBuilder authBuilder = http.getSharedObject(AuthenticationManagerBuilder.class);
        authBuilder.authenticationProvider(trainerDaoAuthenticationProvider());

        http.csrf().disable()
            .httpBasic().disable()
            .authorizeRequests(auth -> auth
                .antMatchers("/Trainer/**/*.*").authenticated()
                .anyRequest().permitAll()
            )
            .formLogin(form -> form
                .usernameParameter("email")
                .passwordParameter("password")
                .loginPage("/Trainer/LogIn")
                .loginProcessingUrl("/Trainer/LogIn")
                .successHandler((req, res, auth) -> res.sendRedirect("/Trainer/Homepage"))
                .permitAll()
            )
            .logout(logout -> logout
                .logoutUrl("/Trainer/LogOut")
                .logoutSuccessUrl("/Trainer/LogIn")
                .deleteCookies("JSESSIONID")
                .permitAll()
            );

        return http.build();
    }

    @Bean
    public DaoAuthenticationProvider trainerDaoAuthenticationProvider() {
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setPasswordEncoder(bCryptPasswordEncoder);
        provider.setUserDetailsService(trainerAppUserService);
        return provider;
    }

    @Bean
    public DaoAuthenticationProvider vereinDaoAuthenticationProvider() {
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setPasswordEncoder(bCryptPasswordEncoder);
        provider.setUserDetailsService(vereinAppUserService);
        return provider;
    }
}

方案二：合并为单个FilterChain #

通过requestMatchers()将不同路径的认证逻辑分组，统一配置在一个FilterChain中：

@Configuration
@EnableWebSecurity
public class WebSecurityConfig {

    private final AppUserService trainerAppUserService;
    private final AppUserService vereinAppUserService;
    private final BCryptPasswordEncoder bCryptPasswordEncoder;

    public WebSecurityConfig(
            @Qualifier("trainer") AppUserService trainerAppUserService,
            @Qualifier("verein") AppUserService vereinAppUserService, BCryptPasswordEncoder bCryptPasswordEncoder) {
        this.trainerAppUserService = trainerAppUserService;
        this.vereinAppUserService = vereinAppUserService;
        this.bCryptPasswordEncoder = bCryptPasswordEncoder;
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        // 配置两个AuthenticationProvider，Spring Security会依次尝试认证
        AuthenticationManagerBuilder authBuilder = http.getSharedObject(AuthenticationManagerBuilder.class);
        authBuilder.authenticationProvider(vereinDaoAuthenticationProvider());
        authBuilder.authenticationProvider(trainerDaoAuthenticationProvider());

        http.csrf().disable()
            .httpBasic().disable()
            // 处理/Verein路径的认证逻辑
            .requestMatchers(matchers -> matchers.antMatchers("/Verein/**"))
            .authorizeRequests(auth -> auth
                .antMatchers("/Verein/LogIn", "/Verein/LogOut").permitAll()
                .antMatchers("/Verein/**/*.*").authenticated()
            )
            .formLogin(form -> form
                .usernameParameter("email")
                .passwordParameter("password")
                .loginPage("/Verein/LogIn")
                .loginProcessingUrl("/Verein/LogIn")
                .successHandler((req, res, auth) -> res.sendRedirect("/Verein/Homepage"))
                .permitAll()
            )
            .logout(logout -> logout
                .logoutUrl("/Verein/LogOut")
                .logoutSuccessUrl("/Verein/LogIn")
                .deleteCookies("JSESSIONID")
                .permitAll()
            )
            // 处理/Trainer路径的认证逻辑
            .and()
            .requestMatchers(matchers -> matchers.antMatchers("/Trainer/**"))
            .authorizeRequests(auth -> auth
                .antMatchers("/Trainer/LogIn", "/Trainer/LogOut").permitAll()
                .antMatchers("/Trainer/**/*.*").authenticated()
            )
            .formLogin(form -> form
                .usernameParameter("email")
                .passwordParameter("password")
                .loginPage("/Trainer/LogIn")
                .loginProcessingUrl("/Trainer/LogIn")
                .successHandler((req, res, auth) -> res.sendRedirect("/Trainer/Homepage"))
                .permitAll()
            )
            .logout(logout -> logout
                .logoutUrl("/Trainer/LogOut")
                .logoutSuccessUrl("/Trainer/LogIn")
                .deleteCookies("JSESSIONID")
                .permitAll()
            )
            // 其他路径允许匿名访问
            .and()
            .authorizeRequests(auth -> auth
                .anyRequest().permitAll()
            );

        return http.build();
    }

    @Bean
    public DaoAuthenticationProvider trainerDaoAuthenticationProvider() {
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setPasswordEncoder(bCryptPasswordEncoder);
        provider.setUserDetailsService(trainerAppUserService);
        return provider;
    }

    @Bean
    public DaoAuthenticationProvider vereinDaoAuthenticationProvider() {
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setPasswordEncoder(bCryptPasswordEncoder);
        provider.setUserDetailsService(vereinAppUserService);
        return provider;
    }
}

注意事项 #

1. 当使用多个AuthenticationProvider时，Spring Security会按配置顺序尝试认证，需确保两个用户服务中的邮箱不重复，否则可能出现认证混淆。
2. 若保留csrf().disable()，需确认应用的安全风险，生产环境建议开启CSRF防护并针对登录路径配置例外。

内容的提问来源于stack exchange，提问作者ResulAksu