Spring Security6 升级高版本解决方案

废弃WebSecurityConfigurerAdapter

spring security中WebSecurityConfigurerAdapter弃用配置AuthenticationManagerBuilder

Spring Security6配置方法

参考代码

部分pom.xml配置

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>3.3.4</version>
</parent>

<dependencies>
	<dependency>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-security</artifactId>
	</dependency>
</dependencies>

SecurityConfig.java

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
@Slf4j
public class SecurityConfig {
    @Resource
    private SecurityFilter securityFilter;
    @Resource
    private UserMapper userMapper;
    @Resource
    private JwtFilter jwtFilter;


    @Bean
    public UserDetailsService userDetailsService() {
        return username -> {
            log.info("从数据库中拿 {} 用户信息", username);
            LambdaQueryWrapper<User> queryWrapper = new LambdaQueryWrapper<User>().eq(User::getUsername, username);
            User user = userMapper.selectOne(queryWrapper);
            if (user == null) {
                throw new UsernameNotFoundException(username);
            }
            return new CustomDetailsUser(user);
        };
    }

    @Bean
    AuthenticationManager authenticationManager() {
        DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider();
        daoAuthenticationProvider.setUserDetailsService(userDetailsService());
        daoAuthenticationProvider.setPasswordEncoder(new BCryptPasswordEncoder(10));
        return new ProviderManager(daoAuthenticationProvider);
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
                // 关闭csrf
                .csrf(AbstractHttpConfigurer::disable)
                // 不通过session获取SecurityContext
                .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .authorizeHttpRequests(auth -> {
                    // 允许登录接口匿名访问
                    auth.requestMatchers("/user/login").anonymous()
                            // 允许接口文档匿名访问
                            .requestMatchers("/v3/api-docs/**").anonymous()
                            .requestMatchers("/doc.html/**").anonymous()
                            .requestMatchers("/swagger-ui/**").anonymous()
                            .requestMatchers("/webjars/**").anonymous()
                            // 除上述之外的全部请求都需要鉴权认证
                            .anyRequest().authenticated();
                })
                // 配置跨域
                .cors(corsConfiguration -> corsConfiguration.configurationSource(corsConfiguration()));


        // 增加过滤器
        http.addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
        http.addFilterBefore(securityFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }


    /**
     * Cors 的配置信息 配置+路径
     */
    CorsConfigurationSource corsConfiguration() {
        // Cors配置类
        CorsConfiguration corsConfiguration = new CorsConfiguration();
        // 是否返回时生成凭证
        corsConfiguration.setAllowCredentials(false);
        // 允许请求携带哪些请求头信息
        corsConfiguration.setAllowedHeaders(List.of("*"));
        // 允许哪些类型的请求方法
        corsConfiguration.setAllowedMethods(List.of("*"));
        // 允许哪些域可以进行方法
        corsConfiguration.setAllowedOrigins(List.of("*"));
        // 设置预检的最大的时长
        corsConfiguration.setMaxAge(3600L);
        // 设置返回暴露的响应头信息
        corsConfiguration.setExposedHeaders(Collections.emptyList());

        // 设置注册URL 配置类
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", corsConfiguration);

        return source;
    }

}