适配Spring Security 6：WebSecurityConfigurerAdapter弃用后的配置改造疑问

由于WebSecurityConfigurerAdapter在Spring Security 6中已被弃用，需对原有安全配置进行适配。

原有配置 #

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Inject
    private UserDetailsService userDetailsService;
    
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService)
            .passwordEncoder(new BCryptPasswordEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
            .authorizeRequests()
                .antMatchers("/v1/**", "/v2/**", "/swagger-ui/**", "/api-docs/**").permitAll()
                .antMatchers("/v3/polls/**").authenticated()
                .and()
            .httpBasic()
                .realmName("Quick Poll")
                .and()
            .csrf()
                .disable();
    }
}

当前尝试的配置 #

@Configuration
public class SecurityConfig {

    @Bean
    public PasswordEncoder encoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
        return authenticationConfiguration.getAuthenticationManager();
    }
}

完整正确的适配配置 #

你的当前配置缺少了HttpSecurity规则配置以及UserDetailsService与认证体系的关联，以下是完整的适配代码：

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig {

    private final UserDetailsService userDetailsService;

    // 构造注入替代@Inject，符合Spring官方推荐规范
    public SecurityConfig(UserDetailsService userDetailsService) {
        this.userDetailsService = userDetailsService;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }

    // 关联UserDetailsService与PasswordEncoder，替代原configure(AuthenticationManagerBuilder)逻辑
    @Bean
    public AuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(userDetailsService);
        authProvider.setPasswordEncoder(passwordEncoder());
        return authProvider;
    }

    // 替代原configure(HttpSecurity)方法，采用Spring Security 6推荐的Lambda风格API
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/v1/**", "/v2/**", "/swagger-ui/**", "/api-docs/**").permitAll()
                .requestMatchers("/v3/polls/**").authenticated()
                .anyRequest().authenticated() // 补充默认规则，可根据实际需求调整
            )
            .httpBasic(basic -> basic.realmName("Quick Poll"))
            .csrf(csrf -> csrf.disable());

        return http.build();
    }
}

关键改动说明 #

• 保留@EnableWebSecurity和@EnableGlobalMethodSecurity(prePostEnabled = true)：前者启用Spring Security核心配置，后者维持原有的方法级权限控制能力（如@PreAuthorize注解）。
• 用SecurityFilterChain替代原configure(HttpSecurity)方法：这是Spring Security 6主推的配置方式，Lambda风格更简洁直观。
• 新增AuthenticationProvider：明确完成UserDetailsService与PasswordEncoder的绑定，替代原AuthenticationManagerBuilder的配置逻辑。

内容的提问来源于stack exchange，提问作者jack nik