Spring Boot SecurityConfig循环依赖问题求助

你的循环依赖根源在于SecurityConfig同时注入了JwtAuthenticate，又在内部定义了它的@Bean方法，加上冗余的configure(AuthenticationManagerBuilder)方法，导致Spring创建Bean时出现自依赖循环。以下是具体修复方案：

方案1：拆分Bean定义（推荐） #

1. 新建单独的认证入口配置类 #

把JwtAuthenticate的Bean定义从SecurityConfig中移出去，避免自依赖：

@Configuration
public class AuthEntryPointConfig {
    @Bean
    public JwtAuthenticate jwtAuthenticate() {
        return new JwtAuthenticate();
    }
}

2. 清理并修改SecurityConfig #

删除冗余方法，保留必要的Bean定义和配置：

@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
public class SecurityConfig {

    private final JwtAuthFilter jwtAuthFilter;
    private final JwtUserDetailsService userDetailsService;
    private final PasswordEncoder passwordEncoder;
    private final JwtAuthenticate jwtAuthenticate; // 现在Bean来自独立配置类

    // 删掉这个旧方法：新的SecurityFilterChain模式下不需要通过AuthenticationManagerBuilder配置
    // public void configure(AuthenticationManagerBuilder auth) throws Exception {
    //     auth.authenticationProvider(authenticationProvider());
    // }

    // 删掉这个内部Bean方法：已移到独立配置类
    // @Bean
    // public JwtAuthenticate jwtAuthenticationEntryPointBean() throws Exception{
    //     return new JwtAuthenticate();
    // }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                .cors().and().csrf().disable()
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers("/**/auth/**").permitAll()
                        .anyRequest().authenticated())
                .exceptionHandling(ex -> ex.authenticationEntryPoint(jwtAuthenticate))
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

        http.addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }

    @Bean
    public AuthenticationProvider authenticationProvider() {
        final DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
        daoAuthenticationProvider.setUserDetailsService(userDetailsService);
        daoAuthenticationProvider.setPasswordEncoder(passwordEncoder);
        return daoAuthenticationProvider;
    }

    @Bean
    public AuthenticationManager authenticationManager(
            AuthenticationConfiguration authenticationConfiguration) throws Exception {
        return authenticationConfiguration.getAuthenticationManager();
    }
}

方案2：直接实例化（更简洁） #

如果JwtAuthenticate不需要依赖其他Bean，可以直接在SecurityConfig中实例化，跳过依赖注入：

@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
public class SecurityConfig {

    private final JwtAuthFilter jwtAuthFilter;
    private final JwtUserDetailsService userDetailsService;
    private final PasswordEncoder passwordEncoder;

    // 删掉JwtAuthenticate注入字段和内部Bean方法

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                .cors().and().csrf().disable()
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers("/**/auth/**").permitAll()
                        .anyRequest().authenticated())
                // 直接实例化JwtAuthenticate，无需注入
                .exceptionHandling(ex -> ex.authenticationEntryPoint(new JwtAuthenticate()))
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

        http.addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }

    // 保留其他Bean方法...
}

关键原因说明 #

1. 自循环根源：SecurityConfig依赖JwtAuthenticate，但JwtAuthenticate的Bean方法又属于SecurityConfig类，导致Spring创建SecurityConfig时需要先拿到JwtAuthenticate，而创建JwtAuthenticate又需要先初始化SecurityConfig，形成闭环。
2. 冗余方法问题：旧的configure(AuthenticationManagerBuilder)方法在新的SecurityFilterChain模式下完全多余——通过@Bean定义的AuthenticationProvider会自动被Spring注册到AuthenticationManager中，保留该方法反而可能引发额外依赖冲突。

内容的提问来源于stack exchange，提问作者John Paulo A. Geronimo