SpringBoot 3.x에서 Security변경사항

 

SpringBoot 2.x버전 --> SpringBoot 3.x버전 으로 올라옴에 따라 .authorizeRequests()가 depreciated되었습니다.

 

SpringBoot 2.x버전

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
    return httpSecurity
        .httpBasic().disable()
        .csrf().disable()
        .cors().and()
        .authorizeRequests()
        //user 목록 admin만 가져올 수 있음
        .antMatchers(HttpMethod.GET, "/users").hasAuthority(Role.ADMIN.name())
        //task 등록 admin만 가능
        .antMatchers(HttpMethod.GET, "/tasks/write").hasAuthority(Role.ADMIN.name())
        .antMatchers(HttpMethod.POST, "/api/v1/tasks").hasAuthority(Role.ADMIN.name())
        .antMatchers(HttpMethod.DELETE, "/api/v1/tasks").hasAuthority(Role.ADMIN.name())
        .antMatchers(HttpMethod.PUT, "/api/v1/tasks").hasAuthority(Role.ADMIN.name())

 

.authorizeRequests가 .authorizeHttpRequests로 바뀌었고

.antMatchers()가 .requestMatchers()로 바뀌었습니다.

 

SpringBoot 3.x버전

.build()대신 .getOrBuild() 를 써야 합니다.

 

참고

https://stackoverflow.com/questions/74993017/unsatisfied-dependency-expressed-through-method-setfilterchains-parameter-0

@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
public class SecurityConfig {

   private final UserService userService;
   @Value("${jwt.token.secret}")
   private String secretKey;
   @Bean
   public SecurityFilterChain securityFilterChain(HttpSecurity httpSecurity) throws Exception {
       return httpSecurity
               .httpBasic().disable()
               // 토큰을 사용하기 때문에 csrf 설정 disable
               .csrf(csrf -> csrf.disable())
               .cors().and()
               .authorizeHttpRequests(requests -> requests
                       .requestMatchers("/api/v1/users/join", "/api/v1/users/login").permitAll()
                       .requestMatchers(HttpMethod.POST, "/api/v1/posts/*").permitAll()
                       .requestMatchers(HttpMethod.GET,"/api/v1/hello/api-auth-test").authenticated()
                       .anyRequest().authenticated())
               .sessionManagement()
                   .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
               .and()
               .exceptionHandling()
               .authenticationEntryPoint(new CustomAuthenticationEntryPoint())
               .and()
               .addFilterBefore(new JwtTokenFilter(userService, secretKey), UsernamePasswordAuthenticationFilter.class)
               .getOrBuild();
   }
}