如何在common-library中引入Spring Security依赖且不触发自动配置

Great question! This is a clean, modular pattern for splitting security concerns across libraries. Let’s walk through the exact steps to make this work smoothly:

Step 1: Add Spring Security to common-library (No Auto-Configuration) #

The goal here is to access Spring Security classes in common-library without letting Spring Boot automatically enable its default security setup. You have two reliable options:

Option A: Use Core Spring Security Dependencies (Skip the Starter) #

Instead of using spring-boot-starter-security (which triggers auto-config by default), directly include the core Security libraries. This gives you all the classes you need without activating any auto-config beans:

Maven (pom.xml):

<dependencies>
    <!-- Core Spring Security classes, no auto-config trigger -->
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-web</artifactId>
        <version>${spring-security.version}</version>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-core</artifactId>
        <version>${spring-security.version}</version>
    </dependency>
</dependencies>

Gradle (build.gradle):

dependencies {
    implementation 'org.springframework.security:spring-security-web:${springSecurityVersion}'
    implementation 'org.springframework.security:spring-security-core:${springSecurityVersion}'
}

Option B: Use the Starter but Exclude Auto-Configuration #

If you prefer using spring-boot-starter-security for dependency management, explicitly block the auto-config classes in common-library's configuration:

1. Add the starter with exclusions:
   Maven:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
    <exclusions>
        <exclusion>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-autoconfigure</artifactId>
        </exclusion>
    </exclusions>
</dependency>

2. Create a configuration class in common-library to explicitly exclude Security auto-config:

@Configuration
@EnableAutoConfiguration(exclude = {
    SecurityAutoConfiguration.class,
    MethodSecurityAutoConfiguration.class
})
public class CommonLibraryConfig {
    // Add any shared config for your library here
}

This ensures even the starter won’t activate default security rules.

Step 2: Handle Security Configuration in secure-library #

secure-library will own all security setup, and it only takes effect when the library is included in an application.

1. Add the Spring Security starter (we want auto-config to be overridden by our custom setup):
   Maven:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<!-- Optional: Depend on common-library to reuse its classes -->
<dependency>
    <groupId>your.group.id</groupId>
    <artifactId>common-library</artifactId>
    <version>${common-library.version}</version>
</dependency>

2. Create a custom Security configuration class. Spring will pick this up automatically when secure-library is on the classpath:

@Configuration
@EnableWebSecurity
// Add @EnableGlobalMethodSecurity if you need method-level security
public class SecureLibrarySecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        // Your custom security rules go here
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .formLogin(form -> form.loginPage("/login").permitAll());
        return http.build();
    }

    // Add other required beans like UserDetailsService, PasswordEncoder, etc.
}

Step 3: Verify the Behavior #

• Only common-library included: Spring Security classes are available for your code, but no security filter chain or default restrictions are activated. Your app runs without Spring Security enforcing rules.
• Both libraries included: Spring scans SecureLibrarySecurityConfig from secure-library, applies your custom rules, and activates Spring Security as intended.

This setup keeps your code clean: common-library holds shared logic that uses Security classes, while secure-library manages all security configuration.

内容的提问来源于stack exchange，提问作者Michal Foksa