Spring Security错误：java.lang.非法状态异常：无法配置任何请求后本身[SpringBoot更新2.1.4->2.3.11]

Question

我正在从2.1.4更新我现有的springstart项目-

扩展的类的退出代码如下

@Override
protected void configure(HttpSecurity http) throws Exception {
             http.authorizeRequests().anyRequest().fullyAuthenticated()
            .and().cors().disable()
            .httpBasic().authenticationEntryPoint(authenticationEntryPoint())
            .and()
            .exceptionHandling()
            .and().csrf().disable()
            .addFilterBefore(new GenericFilter(), ChannelProcessingFilter.class)
            .addFilterBefore(new SomeTokenFilter(tokensService), UsernamePasswordAuthenticationFilter.class)
            .authorizeRequests().anyRequest().authenticated();
}

这是一个在更新之前正在运行的现有代码。更新后，当应用程序启动时，我会看到以下日志：

Caused by: java.lang.IllegalStateException: Can't configure anyRequest after itself
    at org.springframework.util.Assert.state(Assert.java:76) ~[spring-core-5.2.15.RELEASE.jar:5.2.15.RELEASE]
    at org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry.anyRequest(AbstractRequestMatcherRegistry.java:74) ~[spring-security-config-5.3.9.RELEASE.jar:5.3.9.RELEASE]
    at com.moglix.wms.config.SecurityConfig.configure(SecurityConfig.java:48) ~[classes/:na]
    at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.getHttp(WebSecurityConfigurerAdapter.java:231) ~[spring-security-config-5.3.9.RELEASE.jar:5.3.9.RELEASE]
    at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.init(WebSecurityConfigurerAdapter.java:322) ~[spring-security-config-5.3.9.RELEASE.jar:5.3.9.RELEASE]
    at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.init(WebSecurityConfigurerAdapter.java:94) ~[spring-security-config-5.3.9.RELEASE.jar:5.3.9.RELEASE]
    at com.moglix.wms.config.SecurityConfig$$EnhancerBySpringCGLIB$$2778b12e.init(<generated>) ~[classes/:na]
    at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.init(AbstractConfiguredSecurityBuilder.java:370) ~[spring-security-config-5.3.9.RELEASE.jar:5.3.9.RELEASE]
    at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.doBuild(AbstractConfiguredSecurityBuilder.java:324) ~[spring-security-config-5.3.9.RELEASE.jar:5.3.9.RELEASE]
    at org.springframework.security.config.annotation.AbstractSecurityBuilder.build(AbstractSecurityBuilder.java:41) ~[spring-security-config-5.3.9.RELEASE.jar:5.3.9.RELEASE]
    at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.springSecurityFilterChain(WebSecurityConfiguration.java:104) ~[spring-security-config-5.3.9.RELEASE.jar:5.3.9.RELEASE

Answer 1

问题是您的配置中有2次anyRequest（）。从Spring Security 5.2开始，不再允许这样做。