创建名为“springSecurityConfig”的 bean 时出错：当前正在创建请求的 bean：是否存在无法解析的循环引用？

Question

我在使用 BCryptPasswordEncoder 编码我的 inMemory 用户密码时出错

这是我的 springsecurityconfig 文件

弹簧安全配置 class

import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;

@Configuration
@EnableWebSecurity
public class SpringSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .authorizeRequests()
                .anyRequest()
                .authenticated()
                .and()
                .httpBasic();
    }


    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
                .withUser("admin")
                .password(passwordEncoder().encode("password"))
                .roles("USER");
    }

    @Bean
    public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }


}

如何在不出现 bean 创建错误的情况下正确编码密码

Answer 1

您可以使用更基于组件的方法来执行此操作，因为WebSecurityConfigurerAdapter已在5.7.0-M2中弃用。

@Configuration
@EnableWebSecurity
public class SpringSecurityConfig {

    @Bean
    public SecurityFilterChain appSecurity(HttpSecurity http) throws Exception {
        http
                .csrf().disable()
                .authorizeRequests()
                .anyRequest()
                .authenticated()
                .and()
                .httpBasic();
        return http.build()
    }

    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder encoder) {
        User admin = User.withUsername("admin")
            .password(encoder.encode("password"))
            .roles("USER").build();
        return new InMemoryUserDetailsManager(admin);
    }

    @Bean
    public PasswordEncoder passwordEncoder(){
        return new BCryptPasswordEncoder();
    }


}

这样，您可以通过提供InMemoryUserDetailsManager作为UserDetailsService ervice 的实现来进行内存中身份验证，并且此 bean 依赖于PasswordEncoder 。

您可以在参考文档中找到更多详细信息。