Spring Boot 2.5.12升级至2.7.2时Security配置冲突报错

问题原因 #

Spring Security 5.7+版本彻底废弃WebSecurityConfigurerAdapter，且不允许项目同时存在基于WebSecurityConfigurerAdapter的配置和SecurityFilterChain类型Bean，必须二选一，否则触发该异常。

解决方案 #

1. 清理所有WebSecurityConfigurerAdapter相关配置 #

全局搜索项目中所有继承WebSecurityConfigurerAdapter的类，全部替换为新配置方式：

• 原继承WebSecurityConfigurerAdapter的配置类，改为注册SecurityFilterChain Bean
• 原configure(WebSecurity web)的逻辑，改为注册WebSecurityCustomizer Bean实现

2. 排查第三方依赖 #

如果引入的第三方Starter/依赖包含继承WebSecurityConfigurerAdapter的自动配置类：

• 升级依赖到适配Spring Security 5.7+的版本
• 或通过@SpringBootApplication(exclude = {xxxAutoConfiguration.class})排除对应自动配置

3. 修正当前代码的语法错误 #

你的代码存在两处小问题，需先修正：

• BasicAuthC类中antMatchers("/api/anything"")多了一个双引号，改为antMatchers("/api/anything")
• OAuthTwoConfiguration中WebSecurityCustomizer方法名首字母大写，不符合Spring Bean命名规范，改为webSecurityCustomizer

修正后的完整代码示例：

BasicAuthC 配置类

@Configuration
@EnableWebSecurity
@Order(1)
public class BasicAuthC {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
                .requestMatchers().antMatchers("/api/anything")
                .and()
                .authorizeRequests(requests -> requests.anyRequest().fullyAuthenticated())
                .httpBasic();
        return http.build();
    }

    @Bean
    public InMemoryUserDetailsManager memoryUserDetailsManager() {
        PasswordEncoder encoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();

        return new InMemoryUserDetailsManager(User.withUsername("testUserName")
                .password(encoder.encode("****"))
                .authorities(new SimpleGrantedAuthority("SOME_ROLE"))
                .build());
    }
}

OAuthTwoConfiguration 配置类

import com.azure.spring.aad.webapi.AADJwtBearerTokenAuthenticationConverter;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
import org.springframework.security.web.SecurityFilterChain;

@Order(2)
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
@Configuration
public class OAuthTwoConfiguration  {

    @Profile(value="OAUTHPROFILE")
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/api/test").permitAll()
                .and()
                .authorizeRequests((requests) -> requests.anyRequest().authenticated())
                .oauth2ResourceServer()
                .jwt()
                .jwtAuthenticationConverter(new AADJwtBearerTokenAuthenticationConverter());
        return http.build();
    }

    @Profile(value = "test")
    @Bean
    public WebSecurityCustomizer webSecurityCustomizer () throws Exception {
        return (web)->web.ignoring().antMatchers("/someAPI");
    }
}

4. 验证配置 #

完成上述操作后重启项目，确保所有安全配置都基于SecurityFilterChain和WebSecurityCustomizer实现，无任何WebSecurityConfigurerAdapter继承类。

内容的提问来源于stack exchange，提问作者Suraj Mane