升级Spring Boot 3.0.0时WebSecurityConfigurerAdapter错误修复指南

Spring Boot 3.0 依赖的Spring Security 6.x 已移除WebSecurityConfigurerAdapter，需采用基于Bean的配置方式替代原有继承类的写法，以下是适配你现有组件的重写方案：

核心配置代码 #

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.authentication.logout.LogoutFilter;

// 导入你已有的自定义组件
import com.yourpackage.AuthEntryPointJwt;
import com.yourpackage.AuthTokenFilter;
import com.yourpackage.CustomFilter;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig {

    private final AuthEntryPointJwt unauthorizedHandler;
    private final AuthTokenFilter authTokenFilter;
    private final CustomFilter customFilter;

    // 构造注入组件（Spring 推荐写法，替代@Autowired）
    public WebSecurityConfig(AuthEntryPointJwt unauthorizedHandler, 
                             AuthTokenFilter authTokenFilter, 
                             CustomFilter customFilter) {
        this.unauthorizedHandler = unauthorizedHandler;
        this.authTokenFilter = authTokenFilter;
        this.customFilter = customFilter;
    }

    // 保持原有加密逻辑，注册PasswordEncoder Bean
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    // 获取AuthenticationManager，替代原configure(AuthenticationManagerBuilder)方法
    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }

    // 核心HTTP安全规则配置，替代原configure(HttpSecurity)方法
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.csrf(csrf -> csrf.disable()) // 无状态REST接口通常禁用CSRF
            .exceptionHandling(exception -> exception.authenticationEntryPoint(unauthorizedHandler)) // 绑定自定义认证失败入口
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)) // 配置无状态会话
            .authorizeHttpRequests(auth -> 
                auth.requestMatchers("/api/auth/**", "/api/public/**").permitAll() // 开放无需认证的接口路径
                    .anyRequest().authenticated() // 其余所有接口需认证
            );

        // 按原有逻辑添加过滤器，指定执行顺序
        http.addFilterBefore(authTokenFilter, UsernamePasswordAuthenticationFilter.class);
        http.addFilterBefore(customFilter, LogoutFilter.class);

        return http.build();
    }
}

关键改动说明 #

• 移除extends WebSecurityConfigurerAdapter，改用@Bean注册SecurityFilterChain来定义HTTP安全规则
• 通过AuthenticationConfiguration获取AuthenticationManager，替代原有的认证构建器配置方法
• 采用Lambda表达式简化配置（Spring Security 6.x官方推荐写法）
• 组件注入改用构造注入，符合Spring最佳实践
• 过滤器添加逻辑保持不变，通过addFilterBefore/addFilterAfter指定执行顺序

注意事项 #

• 你的AuthTokenFilter如果继承OncePerRequestFilter，原有逻辑无需改动，Spring Security 6.x完全兼容该类
• AuthEntryPointJwt只需保持实现AuthenticationEntryPoint接口即可，原有认证失败处理逻辑不受影响
• 如果原有配置包含自定义UserDetailsService、权限表达式等，只需将相关逻辑迁移为对应的@Bean配置即可

内容的提问来源于stack exchange，提问作者Đỗ Như Vỹ