添加jboss-deployment-structure.xml后Spring SecurityFilterChain重复注册问题求助

Hey Leo, sorry to hear you hit this frustrating snag after adding jboss-deployment-structure.xml! Let's break down why this is happening and walk through how to fix it.

问题根源 #

The core issue here is that adding the JBoss deployment config file is causing your SecurityWebApplicationInitializer (which extends AbstractSecurityWebApplicationInitializer) to execute twice. Each run of the onStartup() method tries to register the springSecurityFilterChain filter, which triggers the duplicate registration error you're seeing.

This usually stems from:

• The jboss-deployment-structure.xml altering JBoss's classloading behavior, leading Spring's WebApplicationInitializer implementations to be detected and initialized twice. For example, if the file imports Spring modules multiple times or sets conflicting classloader rules, it can create separate class instances that trigger duplicate context initializations.
• Your existing web.xml setup (using ContextLoaderListener alongside annotation-based initializers) combining with the changed JBoss rules to spawn two separate Spring application contexts—each triggering the security filter registration.

解决方案 #

1. Audit your jboss-deployment-structure.xml #

First, inspect this file for configurations that might cause duplicate classloading:

• Look for duplicate <module> entries related to Spring (e.g., org.springframework.security, org.springframework.web). If you've explicitly imported these modules multiple times, it can lead to duplicate class instances.
• Ensure you're not mixing application-provided Spring libraries with JBoss module imports. If your WAR already includes Spring JARs, don't import the same modules via JBoss—this creates separate classloaders that trigger duplicate initializations.

2. Replace annotation-based initializer with manual filter registration #

If adjusting the JBoss config doesn't resolve the issue, you can take full control of the filter registration by adding it directly to web.xml, bypassing the automatic logic from AbstractSecurityWebApplicationInitializer.

Update your web.xml with these entries:

<!-- Manual Spring Security Filter Registration -->
<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

Then, remove your SecurityWebApplicationInitializer class—since we're now registering the filter manually, we don't need the initializer to handle it. This guarantees the filter is only registered once, no matter how many times Spring contexts are initialized.

3. Optional: Fix Spring context separation (best practice) #

Looking at your web.xml, you're pointing ContextLoaderListener to mvc-dispatcher-servlet.xml—this is typically meant to be the DispatcherServlet's child context. Splitting your config into separate root and servlet contexts can prevent unexpected duplication:

• Update your web.xml context param to point to a root context file:

  <context-param>
      <param-name>contextConfigLocation</param-name>
      <param-value>/WEB-INF/applicationContext.xml</param-value>
  </context-param>
  

• Create applicationContext.xml to hold core beans (security, services, data sources), leaving only MVC-related config (controllers, mvc:annotation-driven) in mvc-dispatcher-servlet.xml.

内容的提问来源于stack exchange，提问作者LeoScott