如何解决Spring Security默认登录页弹出、自定义登录页失效问题？

问题描述 #

开发类似pastebin.com的Spring Boot应用，原运行正常。添加Spring Security实现注册登录后，访问http://localhost:8080/时，显示的是Spring Security默认登录页，而非自定义的/login页面。

问题分析及修正方案 #

1. 安全配置类无法被实例化 #

SecurityConfiguration被定义为抽象类，Spring无法实例化该类，导致自定义安全配置完全不生效，系统使用默认的Security配置。

修正：移除abstract修饰符：

@Configuration
@EnableWebSecurity
public class SecurityConfiguration { // 去掉abstract
    // ... 其他代码
}

2. 路径授权规则写法错误 #

原代码中用dispatcherTypeMatchers(HttpMethod.valueOf("/registration"))配置路径权限，这是错误的——dispatcherTypeMatchers用于匹配请求分发类型（如REQUEST、FORWARD），而非请求路径。

修正：使用requestMatchers指定无需认证的路径（同时把/login加入，避免访问登录页时被拦截）：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
            .authorizeHttpRequests(auth -> auth
                    .requestMatchers("/registration", "/login").permitAll()
                    .anyRequest().authenticated()
            )
            // ... 其他配置
    return http.build();
}

注：Spring Security 6.x推荐使用SecurityFilterChain Bean的方式配置，替代过时的configure(HttpSecurity)方法

3. 认证提供者未关联用户服务 #

DaoAuthenticationProvider仅设置了密码编码器，但未绑定UserService，导致认证时无法获取用户信息，同时影响配置有效性。

修正：在authenticationProvider()中添加用户服务绑定：

@Bean
public DaoAuthenticationProvider authenticationProvider() {
    DaoAuthenticationProvider auth = new DaoAuthenticationProvider();
    auth.setUserDetailsService(userService); // 绑定UserDetailsService
    auth.setPasswordEncoder(passwordEncoder());
    return auth;
}

4. 重复定义PasswordEncoder Bean #

RegistrationController中重复定义PasswordEncoder Bean，导致Spring容器中出现多个同类型Bean，引发冲突。

修正：删除RegistrationController中的PasswordEncoder Bean定义，改为构造注入：

@Controller
public class RegistrationController {
    private final UserRepository userRepo;
    private final PasswordEncoder passwordEncoder;

    // 构造注入密码编码器
    public RegistrationController(UserRepository userRepo, PasswordEncoder passwordEncoder) {
        this.userRepo = userRepo;
        this.passwordEncoder = passwordEncoder;
    }

    // 删除以下重复代码
    // @Bean
    // public PasswordEncoder passwordEncoder() {
    //     return new BCryptPasswordEncoder();
    // }
}

5. 注册接口路径映射冲突 #

原RegistrationController中的@GetMapping和@PostMapping未指定路径，默认映射到根路径/，与访问根路径时的登录跳转逻辑冲突。

修正：为注册接口指定明确路径，同时注意密码加密后再保存：

@GetMapping("/registration")
public String showRegistrationForm() {
    return "registration";
}

@PostMapping("/registration")
public String registerUserAccount(@ModelAttribute("user") UserRegistrationDTO registrationDTO) {
    User user = new User();
    user.setUsername(registrationDTO.getUsername());
    user.setPassword(passwordEncoder.encode(registrationDTO.getPassword()));
    // 根据实际需求填充其他字段
    userRepo.save(user);
    return "redirect:/registration?success";
}

6. 确认自定义登录页存在 #

确保自定义登录页login.html放置在Thymeleaf默认模板目录src/main/resources/templates/下，且模板语法正确。

修正后完整代码示例 #

SecurityConfiguration.java #

@Configuration
@EnableWebSecurity
public class SecurityConfiguration {

    private final UserService userService;

    public SecurityConfiguration(UserService userService) {
        this.userService = userService;
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider auth = new DaoAuthenticationProvider();
        auth.setUserDetailsService(userService);
        auth.setPasswordEncoder(passwordEncoder());
        return auth;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers("/registration", "/login").permitAll()
                        .anyRequest().authenticated()
                )
                .formLogin(form -> form
                        .loginPage("/login")
                        .permitAll()
                )
                .logout(logout -> logout
                        .invalidateHttpSession(true)
                        .clearAuthentication(true)
                        .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                        .logoutSuccessUrl("/login?logout")
                        .permitAll()
                );
        return http.build();
    }
}

RegistrationController.java #

@Controller
public class RegistrationController {

    private final UserRepository userRepo;
    private final PasswordEncoder passwordEncoder;

    public RegistrationController(UserRepository userRepo, PasswordEncoder passwordEncoder) {
        this.userRepo = userRepo;
        this.passwordEncoder = passwordEncoder;
    }

    @GetMapping("/index")
    public String home() {
        return "index";
    }

    @GetMapping("/login")
    public String login() {
        return "login";
    }

    @ModelAttribute("user")
    public UserRegistrationDTO userRegistrationDTO() {
        return new UserRegistrationDTO();
    }

    @GetMapping("/registration")
    public String showRegistrationForm() {
        return "registration";
    }

    @PostMapping("/registration")
    public String registerUserAccount(@ModelAttribute("user") UserRegistrationDTO registrationDTO) {
        User user = new User();
        user.setUsername(registrationDTO.getUsername());
        user.setPassword(passwordEncoder.encode(registrationDTO.getPassword()));
        // 根据实际需求填充其他字段
        userRepo.save(user);
        return "redirect:/registration?success";
    }
}

内容的提问来源于stack exchange，提问作者CrisV2