Spring Boot 3/Spring Security 6注册后自动登录正确实现方式问询

问题背景 #

我有一个基于Spring Boot 3.x/Spring Security 6.x的表单登录项目，现有Security配置如下，运行正常，注册功能可以将用户保存到数据库，用户后续能正常登录：

@Configuration
public class SecurityConfig {

  @Bean
  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        // 其他配置省略
        .formLogin()
        .loginPage("/users/login")
        // 其他配置省略;
    return http.build();
  }

  @Bean
  public UserDetailsService userDetailsService(UserRepository userRepository) {
    return new AppUserDetailsService(userRepository);
  }

  @Bean
  public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
  }
}

之前在旧版本Spring中，我通过直接设置SecurityContextHolder的方式实现注册后自动登录，但在3.x/6.x版本中不再生效。我猜测需要用到AuthenticationManager，但不清楚如何注入对应Security Filter Chain的本地实例，也不确定是否需要使用AuthenticationManagerResolver<HttpServletRequest>。我试过用HttpServletRequest.login(userName, password)实现，但感觉这种方式不够合理，想知道正确的实现方式是什么？

解决方案 #

1. 暴露对应Security Filter Chain的AuthenticationManager #

在Spring Security 6.x中，AuthenticationManager默认绑定到SecurityFilterChain，需要显式从HttpSecurity中获取并暴露为Bean：

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            // 保留原有配置
            .formLogin()
            .loginPage("/users/login")
            // 其他配置省略;
        return http.build();
    }

    // 新增：暴露AuthenticationManager Bean
    @Bean
    public AuthenticationManager authenticationManager(HttpSecurity http,
                                                      UserDetailsService userDetailsService,
                                                      PasswordEncoder passwordEncoder) throws Exception {
        return http.getSharedObject(AuthenticationManagerBuilder.class)
                .userDetailsService(userDetailsService)
                .passwordEncoder(passwordEncoder)
                .and()
                .build();
    }

    @Bean
    public UserDetailsService userDetailsService(UserRepository userRepository) {
        return new AppUserDetailsService(userRepository);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

2. 在注册服务中实现自动登录逻辑 #

注入AuthenticationManager、SecurityContextHolderStrategy（Spring Security 6.x推荐使用，替代直接操作SecurityContextHolder，更适配多线程/异步场景）、SessionAuthenticationStrategy（处理会话同步，模拟表单登录的会话逻辑）等依赖，完整实现如下：

@Service
public class UserRegistrationService {

    private final UserRepository userRepository;
    private final PasswordEncoder passwordEncoder;
    private final AuthenticationManager authenticationManager;
    private final SecurityContextHolderStrategy securityContextHolderStrategy;
    private final SessionAuthenticationStrategy sessionAuthenticationStrategy;

    // 构造函数注入所有依赖
    public UserRegistrationService(UserRepository userRepository,
                                  PasswordEncoder passwordEncoder,
                                  AuthenticationManager authenticationManager,
                                  SecurityContextHolderStrategy securityContextHolderStrategy,
                                  SessionAuthenticationStrategy sessionAuthenticationStrategy) {
        this.userRepository = userRepository;
        this.passwordEncoder = passwordEncoder;
        this.authenticationManager = authenticationManager;
        this.securityContextHolderStrategy = securityContextHolderStrategy;
        this.sessionAuthenticationStrategy = sessionAuthenticationStrategy;
    }

    public void createAccount(UserRegistrationDTO userRegistrationDTO) {
        // 1. 创建并保存用户到数据库
        UserEntity userEntity = new UserEntity();
        userEntity.setFirstName(userRegistrationDTO.getFirstName())
                  .setLastName(userRegistrationDTO.getLastName())
                  .setEmail(userRegistrationDTO.getEmail())
                  .setPassword(passwordEncoder.encode(userRegistrationDTO.getPassword()));
        userRepository.save(userEntity);

        // 2. 构造未认证的请求Token
        UsernamePasswordAuthenticationToken authRequest =
                UsernamePasswordAuthenticationToken.unauthenticated(
                        userRegistrationDTO.getEmail(),
                        userRegistrationDTO.getPassword()
                );

        // 3. 通过AuthenticationManager完成认证（会自动触发UserDetailsService的验证逻辑）
        Authentication authenticatedAuth = authenticationManager.authenticate(authRequest);

        // 4. 将认证信息设置到SecurityContext
        securityContextHolderStrategy.getContext().setAuthentication(authenticatedAuth);

        // 5. 处理会话同步（模拟表单登录的会话处理，比如更新会话ID防止固定会话攻击）
        sessionAuthenticationStrategy.onAuthentication(authenticatedAuth, null, null);
    }
}

关键说明 #

• 旧方法失效原因：Spring Security 6.x中，直接设置SecurityContextHolder不会触发会话同步逻辑，后续过滤器链无法识别会话中的认证状态；同时跳过AuthenticationManager的认证流程，可能绕过用户状态（如禁用、锁定）的检查。
• 不推荐HttpServletRequest.login的原因：该方法依赖Servlet环境，灵活性差，且会抛出ServletException，处理逻辑不够优雅。

内容的提问来源于stack exchange，提问作者Lachezar Balev