Spring-Security.. 5.1.5 发布到 Spring -Security.. 5.4.6 破坏了安全配置

Question

总结 将 Spring Boot 项目从 2.1.5 RELEASE 更新到 2.4.5 版本。它自动将所有 Spring Security 依赖项从版本 Spring-Security.. 5.1.5 RELEASE 更新到 Spring -Security.. 5.4.6 破坏了安全配置

原因：org.springframework.beans.BeanInstantiationException：无法实例化[javax.servlet.Filter]：工厂方法'springSecurityFilterChain'抛出异常；嵌套异常是 java.lang.IllegalStateException: Can't configure anyRequest after its own 在 org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:185) ~[spring-beans-5.3.6.jar:5.3.6] 在 org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:653) ~[spring-beans-5.3.6.jar:5.3.6] ... 28 更多 引起：java.lang.IllegalStateException: Can't configure anyRequest after its own 在 org.springframework.util.Assert.state(Assert.java:76) ~[spring-core-5.3.6.jar:5.3.6] 在 org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry.anyRequest(AbstractRequestMatcherRegistry.java:72) ~[spring-security-config-5.4.6.jar:5.4.6] 在 com.verizon.wfm.nt.config.SecurityConfig.configure(SecurityConfig.java:14) ~[default/:?] 在 org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.getHttp(WebSecurityConfigurerAdapter.java:217) ~[spring-security-config-5.4.6.jar:5.4.6]

安全配置 工作代码

@EnableWebSecurity
@configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter{
@override
protected void configure(HttpSecurity httpSecurity) throws Exception {
super.configure(httpSecurity);
httpSecurity.authorizeRequests().anyRequest().permitAll();
httpSecurity.csrf().disable();
httpSecurity.headers().frameOptions().disable();
}
}

Answer 1

当调用super.configure(httpSecurity) 时，它会执行以下操作：

http.authorizeRequests((requests) -> requests.anyRequest().authenticated());
http.formLogin();
http.httpBasic();

之后，您将再次使用anyRequest 配置请求。在 Spring Security 的最新版本中是不允许的。

我建议您不要调用super.configure(httpSecurity)，而是禁用默认值并配置它们，如下所示：

@EnableWebSecurity
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter{
    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity.formLogin().disable();
        httpSecurity.httpBasic().disable();
        httpSecurity.authorizeRequests((requests) ->
            requests.anyRequest().permitAll()
        );
        httpSecurity.csrf().disable();
        httpSecurity.headers().frameOptions().disable();
    }
}