能否在无Web环境（Spring Boot/Spring MVC）下使用Spring Security？

能否不依赖Spring Boot/Spring MVC使用Spring Security？ #

当然可以。Spring Security的核心模块（spring-security-core）完全独立于Web相关组件（Spring MVC、Spring Boot自动配置），专门处理认证、授权的核心逻辑，套接字应用、桌面应用等非Web场景都能直接使用。

具体实现步骤 #

1. 引入核心依赖 #

如果用Maven，只需引入spring-security-core，无需Spring Boot或Spring MVC相关依赖：

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-core</artifactId>
    <version>你的Spring Security版本</version>
</dependency>

Gradle配置：

implementation 'org.springframework.security:spring-security-core:你的版本'

2. 定义用户、组、权限模型 #

实现Spring Security的UserDetails接口封装用户信息，同时关联组和权限：

public class CustomUser implements UserDetails {
    private String username;
    private String password;
    private Set<GrantedAuthority> authorities;
    private String groupName;

    // 构造方法、getters
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return authorities;
    }

    @Override
    public String getPassword() {
        return password;
    }

    @Override
    public String getUsername() {
        return username;
    }

    // 实现其他UserDetails方法，根据业务需求返回true/false
    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }

    public String getGroupName() {
        return groupName;
    }
}

其中GrantedAuthority可直接用SimpleGrantedAuthority实现，比如new SimpleGrantedAuthority("WRITE_DATA")；组信息可嵌入用户对象，也可单独定义组实体关联权限后再与用户绑定。

3. 实现用户认证服务 #

实现UserDetailsService接口，从自定义数据源（数据库、文件等）加载用户、组及权限信息：

@Service
public class CustomUserDetailsService implements UserDetailsService {
    private final UserRepository userRepository;

    public CustomUserDetailsService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        UserEntity user = userRepository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("用户不存在: " + username));
        
        Set<GrantedAuthority> authorities = new HashSet<>();
        // 添加组权限
        user.getGroup().getPermissions().forEach(perm -> 
                authorities.add(new SimpleGrantedAuthority(perm.getCode())));
        // 添加用户个人权限
        user.getPermissions().forEach(perm -> 
                authorities.add(new SimpleGrantedAuthority(perm.getCode())));
        
        return new CustomUser(user.getUsername(), user.getPassword(), authorities, user.getGroup().getName());
    }
}

4. 配置Spring Security核心组件 #

创建配置类，手动配置认证管理器和密码编码器，无需Web相关配置：

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true) // 开启方法级授权注解
public class SecurityConfig {
    @Bean
    public PasswordEncoder passwordEncoder() {
        // 生产环境禁止使用明文密码，这里用BCrypt加密
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }

    @Bean
    public UserDetailsService userDetailsService(UserRepository userRepository) {
        return new CustomUserDetailsService(userRepository);
    }
}

@EnableGlobalMethodSecurity用于开启@PreAuthorize、@PostAuthorize等注解，方便在业务逻辑中做权限校验。

5. 在套接字服务中集成认证与授权 #

在套接字请求处理逻辑中，先完成认证，再执行授权校验：

@Component
public class SocketHandler {
    private final AuthenticationManager authenticationManager;
    private final SecurityContextHolderStrategy securityContextHolderStrategy;

    public SocketHandler(AuthenticationManager authenticationManager) {
        this.authenticationManager = authenticationManager;
        // 默认ThreadLocal策略适配套接字多线程模型
        this.securityContextHolderStrategy = SecurityContextHolder.getContextHolderStrategy();
    }

    public void handleSocketRequest(SocketRequest request) {
        UsernamePasswordAuthenticationToken authRequest = 
                new UsernamePasswordAuthenticationToken(request.getUsername(), request.getPassword());
        
        try {
            // 执行认证
            Authentication authentication = authenticationManager.authenticate(authRequest);
            // 将认证信息存入SecurityContext
            securityContextHolderStrategy.setContext(new SecurityContextImpl(authentication));

            // 执行业务逻辑并做授权校验
            doBusinessLogic(request);
        } catch (AuthenticationException e) {
            sendErrorResponse(request.getSocket(), "认证失败: " + e.getMessage());
        } finally {
            // 清理SecurityContext，避免线程污染
            securityContextHolderStrategy.clearContext();
        }
    }

    // 方法级授权：仅拥有READ_DATA权限的用户可执行
    @PreAuthorize("hasAuthority('READ_DATA')")
    private void doBusinessLogic(SocketRequest request) {
        sendSuccessResponse(request.getSocket(), "操作成功");
    }
}

如果使用线程池处理套接字请求，务必在请求结束后清理SecurityContext，防止后续请求获取错误的认证信息。

6. 自定义组级授权（可选） #

如果需要基于用户所属组做权限控制，可直接在注解或代码中判断：

// 注解方式：仅ADMIN_GROUP组用户可执行
@PreAuthorize("principal.groupName == 'ADMIN_GROUP'")
private void adminOnlyOperation(SocketRequest request) {
    // 管理员专属逻辑
}

// 代码手动判断
Authentication auth = securityContextHolderStrategy.getContext().getAuthentication();
CustomUser customUser = (CustomUser) auth.getPrincipal();
if (!"ADMIN_GROUP".equals(customUser.getGroupName())) {
    throw new AccessDeniedException("无权限执行此操作");
}

内容的提问来源于stack exchange，提问作者David Blbulyan