Spring Boot 3.1.x Security配置升级求助（原2.7.x迁移）

以下是完全适配 Spring Boot 3.1.x（对应 Spring Security 6.x）的安全配置代码，完全替代原有基于WebSecurityConfigurerAdapter的写法：

package test.config;

import lombok.RequiredArgsConstructor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.HttpStatusEntryPoint;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.NegatedRequestMatcher;
import org.springframework.security.web.util.matcher.OrRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher;
import org.springframework.security.config.annotation.web.WebSecurityCustomizer;

import static org.springframework.http.HttpStatus.FORBIDDEN;

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(prePostEnabled = true) // 替代原EnableGlobalMethodSecurity
@RequiredArgsConstructor
public class SecurityConfig {

    private static final RequestMatcher PUBLIC_URLS = new OrRequestMatcher(new AntPathRequestMatcher("/public/**"));
    private static final RequestMatcher PROTECTED_URLS = new NegatedRequestMatcher(PUBLIC_URLS);
    private final AuthenticationEntryPoint authenticationEntryPoint; // 修正变量名符合Java编码规范

    @Bean
    public static AuthenticationEntryPoint forbiddenEntryPoint() {
        return new HttpStatusEntryPoint(FORBIDDEN);
    }

    // 配置忽略的公开路径，替代原configure(WebSecurity web)方法
    @Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
        return web -> web.ignoring()
                .requestMatchers(PUBLIC_URLS)
                .requestMatchers(
                        "/", "/csrf", "/configuration/ui",
                        "/webjars/**", "/actuator", "/actuator/*"
                );
    }

    // 核心HTTP安全规则配置，替代原configure(HttpSecurity http)方法
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .exceptionHandling(exceptions -> exceptions
                        .defaultAuthenticationEntryPointFor(forbiddenEntryPoint(), PROTECTED_URLS)
                )
                .csrf(AbstractHttpConfigurer::disable)
                .authorizeHttpRequests(auth -> auth
                        .anyRequest().authenticated()
                )
                .httpBasic(basic -> basic
                        .authenticationEntryPoint(authenticationEntryPoint)
                );

        return http.build();
    }

    // 内存用户认证配置，替代原configureGlobal(AuthenticationManagerBuilder)方法
    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder passwordEncoder) {
        return username -> User.withUsername("userName")
                .password(passwordEncoder.encode("passWord"))
                .roles("Application")
                .build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

关键变更说明 #

• 移除WebSecurityConfigurerAdapter：Spring Security 6.x彻底弃用该类，改用SecurityFilterChain Bean配置HTTP安全规则，WebSecurityCustomizer配置忽略路径。
• 替换注解：用EnableMethodSecurity替代EnableGlobalMethodSecurity，是Spring Security 6的推荐写法，功能完全兼容原注解的prePostEnabled = true配置。
• API更新：authorizeRequests()替换为authorizeHttpRequests()，符合Spring Security 6的新规范。
• 链式写法优化：采用Lambda链式调用替代原.and()拼接，代码更简洁易读。
• 内存认证重构：不再使用AuthenticationManagerBuilder，改用UserDetailsService Bean配置内存用户，适配新的配置模式。

内容的提问来源于stack exchange，提问作者Nani