如何将废弃的WebSecurityConfigurerAdapter转换为SecurityFilterChain?<

Question

我正在做一个项目，我的问题是WebSecurityConfigurerAdapter。这行不通。它说&;类型WebSecurityConfigurerAdapter是不推荐的&;如何转换弃用的WebSecurityConfigurerAdapter到SecurityFilterChain?你能帮我一下吗?我不知道该怎么办

这是我的WebSecurityConfig类:

package com.projectuas.controller;
import com.projectuas.service.UserDetailsServiceImpl;
import org.springframework.context.annotation.*;
import org.springframework.security.authentication.dao.*;
import org.springframework.security.config.annotation.authentication.builders.*;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.*;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@Configuration
@EnableWebSecurity
public class WebSecurityConfig  extends WebSecurityConfigurerAdapter {

@Bean
public UserDetailsService userDetailsService() {
return new UserDetailsServiceImpl();
}

@Bean
public BCryptPasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}

@Bean
public DaoAuthenticationProvider authenticationProvider() {
DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
authProvider.setUserDetailsService(userDetailsService());
authProvider.setPasswordEncoder(passwordEncoder());

return authProvider;
}

@Overide
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.authenticationProvider(authenticationProvider());
}
@Overide
protected void configure(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/").hasAnyAuthority("USER", "ADMIN")
.antMatchers("/new").hasAnyAuthority("ADMIN")
.antMatchers("/edit/**").hasAnyAuthority("ADMIN")
.antMatchers("/delete/**").hasAuthority("ADMIN")
.anyRequest().authenticated()
.and()
.formLogin().permitAll()
.and()
.logout().permitAll()
.and()
.exceptionHandling().accessDeniedPage("/403")
;
}
}

Answer 1

当使用WebSecurityConfigurerAdapter时，我们需要重写以下方法:

@Override
protected void configure(HttpSecurity http) throws Exception {
// http security configuration         
}
@Override
public void configure(WebSecurity web) throws Exception {         
// web security configuration         
}  

如果我们想在不使用WebSecurityConfigurerAdapter的情况下这样做，我们应该通过注册这些bean来替换它们。

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {

}

@Bean
public WebSecurityCustomizer webSecurityCustomizer() {

}

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class WebSecurityConfig {
@Bean
public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception {
return authenticationConfiguration.getAuthenticationManager();
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Bean
public AuthenticationManager authManager(HttpSecurity http, PasswordEncoder passwordEncoder, UserDetailsService userDetailService)
throws Exception {
return http.getSharedObject(AuthenticationManagerBuilder.class)
.userDetailsService(userDetailService)
.passwordEncoder(passwordEncoder)
.and()
.build();
}
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeRequests()
.antMatchers("/").hasAnyAuthority("USER", "ADMIN")
.antMatchers("/new").hasAnyAuthority("ADMIN")
.antMatchers("/edit/**").hasAnyAuthority("ADMIN")
.antMatchers("/delete/**").hasAuthority("ADMIN")
.anyRequest().authenticated()
.and()
.formLogin().permitAll()
.and()
.logout().permitAll()
.and()
.exceptionHandling().accessDeniedPage("/403")
;
return http.build();
}
@Bean
public WebSecurityCustomizer webSecurityCustomizer() {
return (web) -> web.ignoring().antMatchers("/images/**", "/js/**", "/webjars/**");
}

}