提问人:Thomas Kremer 提问时间:9/23/2023 更新时间:9/24/2023 访问量:93
Spring Boot Web Security 应用程序,WebSecurityConfigurerAdapter 已弃用,我可以用什么来代替我的 WebSecurityConfig 类?
Spring Boot Web Security Application, WebSecurityConfigurerAdapter is deprecated, what can I use instead to make my WebSecurityConfig class work?
问:
我是 spring boot 的新手,我正在学习有关 spring boot Web 安全性的教程,该教程应该演示如何设置和配置他们让我们创建的 WebSecurityConfig 类。我遇到的问题是双重的。
首先,他们让我使用 WebSecurityConfigurerAdapter 扩展我的 WebSecurityConfig 类,该类已被弃用,我似乎找不到与如何在任何地方更新它相关的任何内容。我尝试使用 WsCongfigurerAdapater insdead,但这似乎并没有做得更好。
其次是文件底部的 configure 方法,似乎所有的 http 方法,例如 .authorizeHttpRequest()、.authorizeRequest()、.antMatchers()、.requestMatchers() 都被弃用或不正确。
如何更新我的 WebSecurityConfig 类以解决这几个问题?我已将代码包含在 WebSecurityConfig.java 类文件中,以及我收到的消息的图像。
最后,当我使用 WsConfigurerAdapter 时,或者如果我按照他们告诉我的设置方式离开文件时,我无法导航到 /login 路由以外的任何路由。我尝试的所有其他路线都会将我重定向回此路线。
请帮忙。
WebSecurityConfig.java:
package com.securewebapp;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.ws.config.annotation.WsConfigurerAdapter;
import com.securewebapp.auth.MySQLUserDetailsService;
import io.netty.handler.codec.http.HttpMethod;
@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
private MySQLUserDetailsService mySQLUserDetailsService;
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth
.userDetailsService(mySQLUserDetailsService)
.passwordEncoder(passwordEncoder());
}
protected void configure(HttpSecurity http) throws Exception {
http.authorizeHttpRequests()
.antMatchers(HttpMethod, "/", "/home", "/register", "/css/**.css", "/js/**").permitAll()
.anyRequest().authenticated()
.and()
.formLogin()
.loginPage("/login")
.permitAll()
.and()
.logout()
.permitAll();
}
}
[WebSecurityConfigurerAdapter][1]
[![authorizeHttpRequest][2]][2]
[![HttpMethod][3]][3]
[![antMathers][4]][4]
答:
您可以修改现有的 SecurityConfig 以创建 Bean,而不是扩展适配器。
@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {
@Autowired
private MySQLUserDetailsService mySQLUserDetailsService;
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
auth
.userDetailsService(mySQLUserDetailsService)
.passwordEncoder(passwordEncoder());
}
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(auth -> auth
.requestMatchers("/", "/home", "/register", "/css/**.css", "/js/**").permitAll()
.anyRequest().authenticated())
.formLogin(config -> config.loginPage("/login").permitAll())
.logout(LogoutConfigurer::permitAll);
return http.build();
}
}
您可以在 Spring.io 上阅读这篇博文以更好地理解。https://spring.io/blog/2022/02/21/spring-security-without-the-websecurityconfigureradapter
您可能会遇到 AuthenticationManagerBuilder 的问题,并且人们在博客的评论中提出了同样的问题,也许您也可以解决此问题。
评论
我正在使用Springboot3.1.4
@Configuration(proxyBeanMethods = false)
@EnableMethodSecurity
public class WebSecurityConfig {
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Bean
public UserDetailsService userDetailsService() {
return new MySQLUserDetailsService();
}
static class MySQLUserDetailsService implements UserDetailsService{
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
return User.builder().username("admin").password("123456").authorities("admin").build();
}
}
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
return http.authorizeHttpRequests(c -> c.requestMatchers("/", "/home", "/register", "/css/**.css", "/js/**").permitAll().anyRequest().authenticated())
.formLogin(c -> c.loginPage("/login").permitAll())
.logout(LogoutConfigurer::permitAll)
.build();
}
}
评论