Spring从2.7.x迁移至3.1.1时WebSecurityConfigurerAdapter适配问题

以下是适配新版Spring Security（基于SecurityFilterChain）的改造代码，完全对应原配置的功能：

@Configuration
@EnableWebSecurity
public class WebSecurityConfig {

    private final StatelessAuthenticationFilter statelessAuthenticationFilter;
    private final Boolean securityEnabled;

    // 构造注入替代@Autowired（新版推荐）
    public WebSecurityConfig(StatelessAuthenticationFilter statelessAuthenticationFilter,
                             @Value("true") Boolean securityEnabled) {
        this.statelessAuthenticationFilter = statelessAuthenticationFilter;
        this.securityEnabled = securityEnabled;
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        if (!securityEnabled) {
            http.csrf(csrf -> csrf.disable());
            return http.build();
        }

        http
                // 配置无状态会话，对应原sessionManagement().sessionCreationPolicy(STATELESS)
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                // 匹配/re/**路径的请求，对应原antMatcher("/re/**")
                .securityMatcher("/re/**")
                // 授权规则配置，替换原authorizeRequests()
                .authorizeHttpRequests(auth -> auth
                        // /re/au/**允许所有访问，对应原antMatchers("/re/au/**").permitAll()
                        .requestMatchers("/re/au/**").permitAll()
                        // 其他/re/**下的请求需要认证，对应原anyRequest().authenticated()
                        .anyRequest().authenticated())
                // 在UsernamePasswordAuthenticationFilter前添加自定义过滤器，对应原addFilterBefore
                .addFilterBefore(statelessAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
                // 禁用CSRF，对应原csrf().disable()
                .csrf(csrf -> csrf.disable());

        return http.build();
    }
}

关键改动说明 #

• 移除WebSecurityConfigurerAdapter继承，改用@Bean SecurityFilterChain的新式配置方式
• 原antMatcher()替换为securityMatcher()，用于指定当前配置生效的请求路径范围
• 原authorizeRequests()替换为authorizeHttpRequests()，内部的antMatchers()替换为requestMatchers()
• 会话管理、CSRF配置从旧版链式调用改为lambda表达式形式，这是新版替代过时方法的标准写法
• 使用构造注入替代@Autowired，符合Spring官方最佳实践

内容的提问来源于stack exchange，提问作者HappyProgrammer