Spring无法识别WebSecurityConfigurerAdapter问题求助

你遇到的Cannot resolve symbol 'WebSecurityConfigurerAdapter'错误，核心原因是Spring Security 6.0（对应Spring Boot 3.0版本）已彻底移除了WebSecurityConfigurerAdapter抽象类，这是版本迭代带来的API重大变更，和依赖是否齐全无关。

第一步：清理并优化Gradle依赖 #

你的依赖中存在重复项（如多次引入postgresql），且单独引入的spring-security-core、spring-security-config等依赖已被spring-boot-starter-security包含，同时thymeleaf-extras-springsecurity5版本不兼容Spring Security 6.0。优化后的依赖配置如下：

dependencies {
    runtimeOnly 'org.postgresql:postgresql'
    implementation 'org.postgresql:postgresql:42.5.1'
    implementation 'org.springframework.boot:spring-boot-starter-data-jpa'
    implementation 'org.springframework.boot:spring-boot-starter-data-rest'
    implementation 'org.springframework.boot:spring-boot-starter-web'
    implementation 'io.jsonwebtoken:jjwt-api:0.11.5'
    implementation 'org.springframework.boot:spring-boot-starter-validation'
    implementation 'org.springframework.boot:spring-boot-starter-security'
    implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'
    // 替换为适配Spring Security 6的版本
    implementation 'org.thymeleaf.extras:thymeleaf-extras-springsecurity6:3.1.1.RELEASE'
    // JJWT需要补充实现依赖
    runtimeOnly 'io.jsonwebtoken:jjwt-impl:0.11.5'
    runtimeOnly 'io.jsonwebtoken:jjwt-jackson:0.11.5'
}

第二步：重构WebSecurityConfig类 #

Spring Security 6.0采用基于组件Bean的配置方式替代原有的继承WebSecurityConfigurerAdapter的模式，以下是适配你原有逻辑的重构代码：

import nsu.project.springserver.security.jwt.AuthEntryPointJwt;
import nsu.project.springserver.security.jwt.AuthTokenFilter;
import nsu.project.springserver.security.services.UserDetailsServiceImpl;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig {

    @Autowired
    private UserDetailsServiceImpl userDetailsService;

    @Autowired
    private AuthEntryPointJwt unauthorizedHandler;

    @Bean
    public AuthTokenFilter authenticationJwtTokenFilter() {
        return new AuthTokenFilter();
    }

    @Bean
    public AuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(userDetailsService);
        authProvider.setPasswordEncoder(passwordEncoder());
        return authProvider;
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.csrf(csrf -> csrf.disable())
                .exceptionHandling(exception -> exception.authenticationEntryPoint(unauthorizedHandler))
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .authorizeHttpRequests(auth ->
                        // 替换为你实际需要放行的接口路径
                        auth.requestMatchers("/api/auth/**", "/public/**").permitAll()
                                .anyRequest().authenticated()
                );

        http.authenticationProvider(authenticationProvider());
        http.addFilterBefore(authenticationJwtTokenFilter(), UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }
}

关键变更说明： #

1. 用SecurityFilterChain Bean替代原有的configure(HttpSecurity)重写方法
2. 通过AuthenticationConfiguration获取AuthenticationManager，替代原configure(AuthenticationManagerBuilder)逻辑
3. 用DaoAuthenticationProvider配置用户详情服务和密码编码器
4. 保留原有JWT过滤器、异常处理器的逻辑，适配新的配置模式

内容的提问来源于stack exchange，提问作者AllodyUser