Spring Security 6.1, xxx is deprecated and marked for removal

spring security

사이드 프로젝트를 진행하면서 Spring Security 6을 적용하며 만났던 문제들을 적은 내용입니다.

 

WebSecurityConfigurerAdapter Deprecated

---

@RequiredArgsConstructor
@Configuration
@EnableWebSecurity
public class config extends WebSecurityConfigurerAdapter {
    ...
}

이전에는 Spring Security의 기본 설정을 위해 WebSecurityConfigurerAdapter 추상 클래스를 상속하여 configure 메서드를 오버라이드하여 설정했습니다. 그러나 Spring Security 5.7.0-M2부터는 WebSecurityConfigurerAdapter가 deprecated 되었고, Spring 공식 블로그에서는 이를 사용하는 것을 권장하지 않으며, 대신하여 컴포넌트 기반의 설정을 권장합니다.

 

Spring Boot 2.7.x 버전은 Spring Security 5.7.0 버전과 의존성이 있습니다. 현재 Spring Boot 3와 의존 관계인 Spring Security 6에서는 WebSecurityConfigurerAdapter 클래스가 제거되었습니다. Spring Boot의 버전을 3.x로 업그레이드하기 위해 Spring Boot 3는 Spring Security 6을 사용하기 때문에 WebSecurityConfigurerAdapter의 deprecated 된 설정을 제거해야 합니다.

 

해당 이슈에 대해 알고 있었기에 WebSecurityConfigurerAdapter를 사용하지 않는 방법을 알고 있어 적용했습니다.

 

---

 

WebSecurityConfigurerAdapter 코드 변경

---

WebSecurityConfigurerAdapter 사용

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        return http
                .authorizeRequests()
                .antMatchers("/login", "/sign-up", "/user").permitAll()
                .anyRequest().authenticated()
                .formLogin()
                .loginPage("/login")
                .defaultSeccessUrl("/home")
                .and()
                .logout()
                .logoutSuccessUrl("/login")
                .csrf().disable()
                .build();
    }
}

 

WebSecurityConfigurerAdapter에서 SecurityFilterChain 사용

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
                .authorizeRequests()
                .antMatchers("/login", "/sign-up", "/user").permitAll()
                .anyRequest().authenticated()
                .formLogin()
                .loginPage("/login")
                .defaultSeccessUrl("/home")
                .and()
                .logout()
                .logoutSuccessUrl("/login")
                .csrf().disable()
                .build();
    }
}

WebSecurityConfigurerAdapter를 제거하고 대신 @Bean 애노테이션을 사용하여 빈으로 등록할 때는 HttpSecurity 자체를 변경할 필요는 없지만, 메서드 이름은 configure 대신에 filterChain으로 변경해야 합니다. 그러나 해당 방식으로 수정한 결과 xxx is deprecated and marked for removal 오류가 발생되었습니다.

 

---

 

xxx is deprecated and marked for removal 문제 발생

---

Spring Security 6에서 WebSecurityConfigurerAdapter를 삭제하고 SecurityFilterChain 빈을 생성했으나 "xxx is deprecated and marked for removal"과 같은 오류를 만나게 되었습니다. 

 

해당 원인을 찾아본 결과 Spring Security 6.1.0 부터 메서드 체이닝 대신 람다식을 통해 함수형으로 설정하도록 권장하고 있었습니다. 이를 해결하기 위해 기존의 메서드 체이닝 방식 대신 함수형 설정 방식으로 바꿔야 합니다.

 

람다식(함수형)으로 변경

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
                .authorizeHttpRequests(authorize -> authorize
                        .requestMatchers("/login", "/sign-up", "/user").permitAll()
                        .anyRequest().authenticated())
                .formLogin(configurer -> configurer
                        .loginPage("/login")
                        .defaultSuccessUrl("/"))
                .logout(configurer -> configurer
                        .logoutSuccessUrl("/login")
                        .invalidateHttpSession(true))
                .csrf(AbstractHttpConfigurer::disable)
                .build();
    }
}

 

---

Spring Security without the WebSecurityConfigurerAdapter