Spring Security 替换WebSecurityConfigurerAdapter (Deprecated)的方法

野性酷女 2023-09-25 12:51 102阅读 0赞

在本文中，我将提供一个解决方案来配置Spring 安全性，而无需 WebSecurityConfigurerAdapter 类。从 Spring Security 5.7 开始，*WebSecurityConfigurerAdapter*类已被弃用，Spring 团队鼓励用户转向基于组件的安全配置。

## 使用 WebSecurityConfigurerAdapter ##

在*WebSecurityConfigurerAdapter*类被弃用之前，我们正在编写这样的代码。我们创建了一个Spring Java配置类，它扩展了*WebSecurityConfigurerAdapter*类并覆盖了几个*configure（）*方法：

@Configuration
    @EnableWebSecurity
    public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            // configure HTTP security...         
        }
     
        @Override
        public void configure(WebSecurity web) throws Exception {         
            // configure Web security...         
        }      
    }

从春季安全 5.7.0-M2 开始。WebSecurityConfigurerAdapter类已被弃用，**Spring 团队鼓励用户转向基于组件的安全配置。**

## 没有网络安全配置器适配器 ##

在使用基于组件的 Spring 安全配置的新方法中，您需要遵循以下非常简单的步骤：

1. 删除 WebSecurityConfigurerAdapter 类（不要扩展*WebSecurityConfigurerAdapter*）

2. 删除*网络安全配置器适配器*类的所有重写方法

3. 使用*SecurityFilterChain 配置 HttpSecurity*，使用*WebSecurityCustomizer 配置 WebSecurity*：

@Configuration
    @EnableWebSecurity
    public class SecurityConfiguration {
             
        @Bean
        public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
          // configure HTTP security...     
        }
         
        @Bean
        public WebSecurityCustomizer webSecurityCustomizer() {
              // configure Web security...   
        }    
    }

让我们看一个完整的示例供您参考。

## 没有网络安全的 Spring 安全性配置器适配器示例 ##

考虑我们在下面使用*WebSecurityConfigurerAdapter*类进行 Spring 安全配置，稍后我们将看到如何将此安全配置迁移到基于组件的方法。

package net.javaguides.springboot.config;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
    
    import net.javaguides.springboot.service.UserService;
    
    @Configuration
    @EnableWebSecurity
    public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    
    	@Autowired
    	private UserService userService;
    	
    	@Bean
        public BCryptPasswordEncoder passwordEncoder() {
            return new BCryptPasswordEncoder();
        }
    	
    	@Bean
        public DaoAuthenticationProvider authenticationProvider() {
            DaoAuthenticationProvider auth = new DaoAuthenticationProvider();
            auth.setUserDetailsService(userService);
            auth.setPasswordEncoder(passwordEncoder());
            return auth;
        }
    	
    	@Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.authenticationProvider(authenticationProvider());
        }
    	
    	@Override
    	protected void configure(HttpSecurity http) throws Exception {
    		http.authorizeRequests().antMatchers(
    				 "/registration**",
    	                "/js/**",
    	                "/css/**",
    	                "/img/**").permitAll()
    		.anyRequest().authenticated()
    		.and()
    		.formLogin()
    		.loginPage("/login")
    		.permitAll()
    		.and()
    		.logout()
    		.invalidateHttpSession(true)
    		.clearAuthentication(true)
    		.logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
    		.logoutSuccessUrl("/login?logout")
    		.permitAll();
    	}
    
    }

GitHub 链接：[registration-login-spring-boot-security-thymeleaf-hibernate/SecurityConfiguration.java at master · RameshMF/registration-login-spring-boot-security-thymeleaf-hibernate · GitHub][registration-login-spring-boot-security-thymeleaf-hibernate_SecurityConfiguration.java at master _ RameshMF_registration-login-spring-boot-security-thymeleaf-hibernate _ GitHub]

接下来，这是没有 WebSecurityConfigurerAdapter 的基于组件的替代方法：

package net.javaguides.springboot.config;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.security.crypto.password.PasswordEncoder;
    import org.springframework.security.web.SecurityFilterChain;
    import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
    
    @Configuration
    @EnableWebSecurity
    public class SpringSecurity {
    
    //    @Autowired
    //    private UserDetailsService userDetailsService;
    
        @Bean
        public static PasswordEncoder passwordEncoder(){
            return new BCryptPasswordEncoder();
        }
    
        // configure SecurityFilterChain
        @Bean
        public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
            http.csrf().disable()
                    .authorizeRequests()
                    .antMatchers("/register/**").permitAll()
                    .antMatchers("/index").permitAll()
                    .antMatchers("/users").hasRole("ADMIN")
                    .and()
                    .formLogin(
                            form -> form
                                    .loginPage("/login")
                                    .loginProcessingUrl("/login")
                                    .defaultSuccessUrl("/users")
                                    .permitAll()
                    ).logout(
                            logout -> logout
                                    .logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                                    .permitAll()
    
                    );
            return http.build();
        }
    
    //    @Autowired
    //    public void configureGlobal(AuthenticationManagerBuilder builder) throws Exception {
           
    //        builder.userDetailsService(userDetailsService)
    //                .passwordEncoder(passwordEncoder());
    //    }
    }

在上面的例子中，我们遵循最佳实践，使用 Spring Security lambda DSL 和方法*HttpSecurity\#authorizeHttpRequests*来定义我们的授权规则。如果你不熟悉lambda DSL，你可以在[这篇博文][Link 1]中阅读它。

**重要：**我们不再需要手动将*UserDetailsService*和*PasswordEncoder*设置为AuthenticationManager实例，它只需要存在于spring上下文中。一旦我们将*UserDetailsService*和*PasswordEncoder*配置为Spring bean，Spring Security就会自动设置为*AuthenticationManager*。

## Spring Security JWT （JSON Web Token） without WebSecurityConfigurerAdapter ##

考虑我们有以下的 spring 安全性和使用*WebSecurityConfigurerAdapter*类的 JWT 配置，稍后我们将看到如何将此安全配置迁移到基于组件的方法。

package com.springboot.blog.config;
    
    import com.springboot.blog.security.CustomUserDetailsService;
    import com.springboot.blog.security.JwtAuthenticationEntryPoint;
    import com.springboot.blog.security.JwtAuthenticationFilter;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.http.HttpMethod;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.config.http.SessionCreationPolicy;
    import org.springframework.security.core.userdetails.User;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.security.crypto.password.PasswordEncoder;
    import org.springframework.security.provisioning.InMemoryUserDetailsManager;
    import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
    
    @Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public class SecurityConfig extends WebSecurityConfigurerAdapter {
    
        @Autowired
        private CustomUserDetailsService userDetailsService;
    
        @Autowired
        private JwtAuthenticationEntryPoint authenticationEntryPoint;
    
        @Bean
        public JwtAuthenticationFilter jwtAuthenticationFilter(){
            return  new JwtAuthenticationFilter();
        }
    
        @Bean
        PasswordEncoder passwordEncoder(){
            return new BCryptPasswordEncoder();
        }
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                    .csrf().disable()
                    .exceptionHandling()
                    .authenticationEntryPoint(authenticationEntryPoint)
                    .and()
                    .sessionManagement()
                    .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                    .and()
                    .authorizeRequests()
                    .antMatchers(HttpMethod.GET, "/api/v1/**").permitAll()
                    .antMatchers("/api/v1/auth/**").permitAll()
                    .antMatchers("/v2/api-docs/**").permitAll()
                    .antMatchers("/swagger-ui/**").permitAll()
                    .antMatchers("/swagger-resources/**").permitAll()
                    .antMatchers("/swagger-ui.html").permitAll()
                    .antMatchers("/webjars/**").permitAll()
                    .anyRequest()
                    .authenticated();
            http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
        }
    
        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.userDetailsService(userDetailsService)
                    .passwordEncoder(passwordEncoder());
        }
    
        @Override
        @Bean
        public AuthenticationManager authenticationManagerBean() throws Exception {
            return super.authenticationManagerBean();
        }
    
        //    @Override
    //    @Bean
    //    protected UserDetailsService userDetailsService() {
           
    //        UserDetails ramesh = User.builder().username("ramesh").password(passwordEncoder()
    //                .encode("password")).roles("USER").build();
    //        UserDetails admin = User.builder().username("admin").password(passwordEncoder()
    //                .encode("admin")).roles("ADMIN").build();
    //        return new InMemoryUserDetailsManager(ramesh, admin);
    //    }
    }

GitHub 链接：[springboot-blog-rest-api/SecurityConfig.java at main · RameshMF/springboot-blog-rest-api · GitHub][springboot-blog-rest-api_SecurityConfig.java at main _ RameshMF_springboot-blog-rest-api _ GitHub]

接下来，这是没有 WebSecurityConfigurerAdapter 的基于组件的替代方法：

package com.springboot.blog.config;
    
    import com.springboot.blog.security.CustomUserDetailsService;
    import com.springboot.blog.security.JwtAuthenticationEntryPoint;
    import com.springboot.blog.security.JwtAuthenticationFilter;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.http.HttpMethod;
    import org.springframework.security.authentication.AuthenticationManager;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
    import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.config.http.SessionCreationPolicy;
    import org.springframework.security.core.userdetails.User;
    import org.springframework.security.core.userdetails.UserDetails;
    import org.springframework.security.core.userdetails.UserDetailsService;
    import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
    import org.springframework.security.crypto.password.PasswordEncoder;
    import org.springframework.security.provisioning.InMemoryUserDetailsManager;
    import org.springframework.security.web.SecurityFilterChain;
    import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
    
    @Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public class SecurityConfig {
    
        @Autowired
        private CustomUserDetailsService userDetailsService;
    
        @Autowired
        private JwtAuthenticationEntryPoint authenticationEntryPoint;
    
        @Bean
        public JwtAuthenticationFilter jwtAuthenticationFilter(){
            return  new JwtAuthenticationFilter();
        }
    
        @Bean
        PasswordEncoder passwordEncoder(){
            return new BCryptPasswordEncoder();
        }
    
        @Bean
        protected SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
            http
                    .csrf().disable()
                    .exceptionHandling()
                    .authenticationEntryPoint(authenticationEntryPoint)
                    .and()
                    .sessionManagement()
                    .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                    .and()
                    .authorizeRequests((authorize) -> authorize
                            .antMatchers(HttpMethod.GET, "/api/v1/**").permitAll()
                            .antMatchers("/api/v1/auth/**").permitAll()
                            .antMatchers("/v2/api-docs/**").permitAll()
                            .antMatchers("/swagger-ui/**").permitAll()
                            .antMatchers("/swagger-resources/**").permitAll()
                            .antMatchers("/swagger-ui.html").permitAll()
                            .antMatchers("/webjars/**").permitAll()
                            .anyRequest()
                            .authenticated()
                    );
            http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
            return http.build();
        }
    
    
    //    @Override
    //    protected void configure(HttpSecurity http) throws Exception {
           
    //        http
    //                .csrf().disable()
    //                .exceptionHandling()
    //                .authenticationEntryPoint(authenticationEntryPoint)
    //                .and()
    //                .sessionManagement()
    //                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
    //                .and()
    //                .authorizeRequests()
    //                .antMatchers(HttpMethod.GET, "/api/v1/**").permitAll()
    //                .antMatchers("/api/v1/auth/**").permitAll()
    //                .antMatchers("/v2/api-docs/**").permitAll()
    //                .antMatchers("/swagger-ui/**").permitAll()
    //                .antMatchers("/swagger-resources/**").permitAll()
    //                .antMatchers("/swagger-ui.html").permitAll()
    //                .antMatchers("/webjars/**").permitAll()
    //                .anyRequest()
    //                .authenticated();
    //        http.addFilterBefore(jwtAuthenticationFilter(), UsernamePasswordAuthenticationFilter.class);
    //    }
    
        @Bean
        public AuthenticationManager authenticationManager(
                AuthenticationConfiguration authenticationConfiguration) throws Exception {
            return authenticationConfiguration.getAuthenticationManager();
        }
    
    //    @Override
    //    @Bean
    //    public AuthenticationManager authenticationManagerBean() throws Exception {
           
    //        return super.authenticationManagerBean();
    //    }
    
        //    @Override
    //    @Bean
    //    protected UserDetailsService userDetailsService() {
           
    //        UserDetails ramesh = User.builder().username("ramesh").password(passwordEncoder()
    //                .encode("password")).roles("USER").build();
    //        UserDetails admin = User.builder().username("admin").password(passwordEncoder()
    //                .encode("admin")).roles("ADMIN").build();
    //        return new InMemoryUserDetailsManager(ramesh, admin);
    //    }
    }

GitHub 链接：[springboot-blog-rest-api/SecurityConfig.java at spring-security-deprecated-solution · RameshMF/springboot-blog-rest-api · GitHub][springboot-blog-rest-api_SecurityConfig.java at spring-security-deprecated-solution _ RameshMF_springboot-blog-rest-api _ GitHub]

## 没有网络安全配置器适配器的分步完整示例 ##

[Spring 引导用户注册和登录示例教程][Spring]/**/ 最新**

## 引用 ##

*  [Spring 引导用户注册和登录示例教程][Spring]
 *  [没有 WebSecurityConfigurerAdapter 的 Spring 安全性][WebSecurityConfigurerAdapter _ Spring]

[registration-login-spring-boot-security-thymeleaf-hibernate_SecurityConfiguration.java at master _ RameshMF_registration-login-spring-boot-security-thymeleaf-hibernate _ GitHub]: https://github.com/RameshMF/registration-login-spring-boot-security-thymeleaf-hibernate/blob/master/src/main/java/net/javaguides/springboot/config/SecurityConfiguration.java
[Link 1]: https://spring.io/blog/2019/11/21/spring-security-lambda-dsl
[springboot-blog-rest-api_SecurityConfig.java at main _ RameshMF_springboot-blog-rest-api _ GitHub]: https://github.com/RameshMF/springboot-blog-rest-api/blob/main/src/main/java/com/springboot/blog/config/SecurityConfig.java
[springboot-blog-rest-api_SecurityConfig.java at spring-security-deprecated-solution _ RameshMF_springboot-blog-rest-api _ GitHub]: https://github.com/RameshMF/springboot-blog-rest-api/blob/spring-security-deprecated-solution/src/main/java/com/springboot/blog/config/SecurityConfig.java
[Spring]: https://www.javaguides.net/2018/10/user-registration-module-using-springboot-springmvc-springsecurity-hibernate5-thymeleaf-mysql.html
[WebSecurityConfigurerAdapter _ Spring]: https://spring.io/blog/2022/02/21/spring-security-without-the-websecurityconfigureradapter