[Spring Boot] WebSecurityConfigurerAdapter Deprecated 대처

스프링 시큐리티 5.7 부터 WebSecurityConfigurerAdapter가 Deprecated 되었습니다.

 

기존

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests((authz) -> authz
                .anyRequest().authenticated()
            )
            .httpBasic(withDefaults());
    }

}

변경 (필터체인 빈 등록)

@Configuration
public class SecurityConfiguration {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests((authz) -> authz
                .anyRequest().authenticated()
            )
            .httpBasic(withDefaults());
        return http.build();
    }

}

 

 

 

기존

@Configuration
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(WebSecurity web) {
        web.ignoring().antMatchers("/ignore1", "/ignore2");
    }

}

변경 

@Configuration
public class SecurityConfiguration {

    @Bean
    public WebSecurityCustomizer webSecurityCustomizer() {
        return (web) -> web.ignoring().antMatchers("/ignore1", "/ignore2");
    }

}

 

 

WebSecurityConfigurerAdapter 메서드 오버라이딩이 아니라, 필요한 클래스 빈을 등록하는 방식으로 구현하시면 됩니다.

 

참고 1 : https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.html

참고 2 : https://spring.io/blog/2022/02/21/spring-security-without-the-websecurityconfigureradapter