如何实现管理员与用户双登录页面？Spring Security配置求助

我需要为管理员和用户分别设置独立的登录页面，当前用Spring Security配置了两个SecurityFilterChain，但遇到以下问题：

• 添加@Order注解时，只有标注@Order(1)的配置生效
• 移除@Order注解后，只有最后一个配置生效
• 拆分到不同配置文件也无法解决问题

期望两个登录页面都能正常工作，相关配置代码如下：

package com.example.FlightAgency.security;
import com.example.FlightAgency.service.UserService;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Configuration
    @Order(1)
    public static class App1ConfigurationAdapter {
        @Bean
        public UserDetailsService userDetailsService() {
            return new UserService();
        }

        @Bean
        public PasswordEncoder passwordEncoder() {
            return NoOpPasswordEncoder.getInstance();
        }

        @Bean
        public SecurityFilterChain filterChainApp1(HttpSecurity http) throws Exception {
            http
                .authorizeRequests()
                    .requestMatchers("/user/**").hasAuthority("USER")
                    .and()
                .formLogin()
                    .loginPage("/user/login")
                    .usernameParameter("email")
                    .loginProcessingUrl("/user/login")
                    .defaultSuccessUrl("/user/")
                    .permitAll()
                    .and()
                .logout()
                    .logoutUrl("/user/logout")
                    .logoutSuccessUrl("/user/login")
                    .deleteCookies("JSESSIONID")
                    .and()
                .exceptionHandling()
                    .accessDeniedPage("/403")
                    .and()
                .csrf().disable();
            return http.build();
        }
    }

    @Configuration
    @Order(2)
    public static class App2ConfigurationAdapter {

        @Bean
        public SecurityFilterChain filterChainApp2(HttpSecurity http) throws Exception {
            http
                .authorizeRequests()
                    .requestMatchers("/admin/**").hasAuthority("ADMIN")
                    .and()
                .formLogin()
                    .loginPage("/admin/login")
                    .usernameParameter("email")
                    .loginProcessingUrl("/admin/login")
                    .defaultSuccessUrl("/admin/")
                    .permitAll()
                    .and()
                .logout()
                    .logoutUrl("/admin/logout")
                    .logoutSuccessUrl("/admin/login")
                    .deleteCookies("JSESSIONID")
                    .and()
                .exceptionHandling()
                    .accessDeniedPage("/403")
                    .and()
                .csrf().disable();
            return http.build();
        }
    }
}

问题原因 #

你的配置存在两个核心问题：

1. 未限定FilterChain的拦截路径：第一个过滤器链没有指定仅处理/user/**路径，会拦截所有请求，导致第二个链完全没有触发机会。
2. Bean重复定义：UserDetailsService和PasswordEncoder在第一个内部类中定义，会成为全局Bean，但重复定义可能引发潜在冲突，且没必要在每个链中单独声明。

修复后的配置 #

为每个SecurityFilterChain添加路径匹配限定，确保各自处理对应前缀的请求，同时统一全局Bean定义：

package com.example.FlightAgency.security;
import com.example.FlightAgency.service.UserService;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    // 全局共享的用户服务和密码编码器，无需在每个内部类重复定义
    @Bean
    public UserDetailsService userDetailsService() {
        return new UserService();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return NoOpPasswordEncoder.getInstance();
    }

    @Configuration
    @Order(1)
    public static class UserSecurityConfig {
        @Bean
        public SecurityFilterChain userFilterChain(HttpSecurity http) throws Exception {
            // 关键：限定此链仅处理/user/**路径的请求
            http
                .requestMatchers()
                    .antMatchers("/user/**")
                    .and()
                .authorizeRequests()
                    .antMatchers("/user/login").permitAll() // 明确放行登录页
                    .anyRequest().hasAuthority("USER")
                    .and()
                .formLogin()
                    .loginPage("/user/login")
                    .usernameParameter("email")
                    .loginProcessingUrl("/user/login")
                    .defaultSuccessUrl("/user/")
                    .permitAll()
                    .and()
                .logout()
                    .logoutUrl("/user/logout")
                    .logoutSuccessUrl("/user/login")
                    .deleteCookies("JSESSIONID")
                    .and()
                .exceptionHandling()
                    .accessDeniedPage("/403")
                    .and()
                .csrf().disable();
            return http.build();
        }
    }

    @Configuration
    @Order(2)
    public static class AdminSecurityConfig {
        @Bean
        public SecurityFilterChain adminFilterChain(HttpSecurity http) throws Exception {
            // 关键：限定此链仅处理/admin/**路径的请求
            http
                .requestMatchers()
                    .antMatchers("/admin/**")
                    .and()
                .authorizeRequests()
                    .antMatchers("/admin/login").permitAll() // 明确放行登录页
                    .anyRequest().hasAuthority("ADMIN")
                    .and()
                .formLogin()
                    .loginPage("/admin/login")
                    .usernameParameter("email")
                    .loginProcessingUrl("/admin/login")
                    .defaultSuccessUrl("/admin/")
                    .permitAll()
                    .and()
                .logout()
                    .logoutUrl("/admin/logout")
                    .logoutSuccessUrl("/admin/login")
                    .deleteCookies("JSESSIONID")
                    .and()
                .exceptionHandling()
                    .accessDeniedPage("/403")
                    .and()
                .csrf().disable();
            return http.build();
        }
    }
}

关键修改说明 #

• 路径限定：通过requestMatchers().antMatchers("/xxx/**")为每个FilterChain指定专属处理路径，避免请求被第一个链全盘拦截。
• 全局Bean统一：将UserDetailsService和PasswordEncoder提取到外层配置类，作为全局Bean供两个链共享，消除重复定义的冲突风险。
• 明确放行登录页：在权限配置中显式放行登录页面路径，确保未登录用户能正常访问登录入口。

内容的提问来源于stack exchange，提问作者uziak