如何将Spring记住我相关XML Bean配置转为Java类配置并禁用auto-config

1 核心配置说明 #

• 对应XML中auto-config="false"的效果：Java配置中无需主动调用formLogin()、httpBasic()、logout()等自动配置相关方法即可实现，Spring Security不会自动注册默认的认证、注销相关过滤器。
• 三个自定义Bean完全匹配原XML配置的逻辑，依赖的userService需要替换为你自己实现的UserDetailsService实例。

2 完整Java配置代码 #

适配Spring Security 5.7及之前版本（继承WebSecurityConfigurerAdapter写法） #

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.RememberMeAuthenticationProvider;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter;
import org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices;

import javax.annotation.Resource;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    // 替换为自己实现的UserDetailsService实例，对应原XML的userService
    @Resource
    private UserDetailsService userService;

    // 记住我功能签名密钥，和原XML配置的some-string保持一致
    private static final String REMEMBER_ME_KEY = "some-string";

    // 对应原XML的rememberMeServices Bean
    @Bean
    public TokenBasedRememberMeServices rememberMeServices() {
        TokenBasedRememberMeServices services = new TokenBasedRememberMeServices(REMEMBER_ME_KEY, userService);
        // 如有token有效期等其他参数配置，可在此处调用对应set方法设置
        return services;
    }

    // 对应原XML的rememberMeAuthenticationProvider Bean
    @Bean
    public RememberMeAuthenticationProvider rememberMeAuthenticationProvider() {
        return new RememberMeAuthenticationProvider(REMEMBER_ME_KEY);
    }

    // 对应原XML的rememberMeFilter Bean
    @Bean
    public RememberMeAuthenticationFilter rememberMeFilter() throws Exception {
        return new RememberMeAuthenticationFilter(authenticationManager(), rememberMeServices());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // 此处不调用formLogin()、httpBasic()等方法，即等价于auto-config="false"
        http
            // 可自行添加路径拦截等其他权限规则
            .authorizeRequests()
                .anyRequest().authenticated()
            .and()
                .addFilter(rememberMeFilter())
                .authenticationProvider(rememberMeAuthenticationProvider());
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
}

适配Spring Security 5.7+版本（废弃WebSecurityConfigurerAdapter后的组件式写法） #

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.RememberMeAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter;
import org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices;

import javax.annotation.Resource;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Resource
    private UserDetailsService userService;

    private static final String REMEMBER_ME_KEY = "some-string";

    @Bean
    public TokenBasedRememberMeServices rememberMeServices() {
        return new TokenBasedRememberMeServices(REMEMBER_ME_KEY, userService);
    }

    @Bean
    public RememberMeAuthenticationProvider rememberMeAuthenticationProvider() {
        return new RememberMeAuthenticationProvider(REMEMBER_ME_KEY);
    }

    @Bean
    public RememberMeAuthenticationFilter rememberMeFilter(AuthenticationConfiguration authenticationConfiguration) throws Exception {
        AuthenticationManager authenticationManager = authenticationConfiguration.getAuthenticationManager();
        return new RememberMeAuthenticationFilter(authenticationManager, rememberMeServices());
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http, RememberMeAuthenticationFilter rememberMeFilter, RememberMeAuthenticationProvider rememberMeProvider) throws Exception {
        // 不调用formLogin()、httpBasic()等方法，等价于auto-config="false"
        http
            .authorizeRequests()
                .anyRequest().authenticated()
            .and()
                .addFilter(rememberMeFilter)
                .authenticationProvider(rememberMeProvider);
        return http.build();
    }
}

内容的提问来源于stack exchange，提问作者Michael Joseph Jackson