Open jimmyjames opened 1 year ago
FWIW, I don't think you need @EnableWebSecurity
anymore, just @Configuration
. I sent an email to Rob Winch to confirm it's the same for Spring WebFlux.
Testing it out, it appears both servlet and WebFlux work without @EnableSpringSecurity
. I'll push a new commit to remove @EnableWebSecurity
.
@jimmyjames Is there anything I can do to help move this along?
For those using or upgrading to Spring Boot 3 with Spring Security 6, we will be either creating a new sample repo and corresponding quickstart article, or updating this sample and the existing quickstart. In the meantime, let's use this issue to discuss any issues and share tips that may help others.
Trying the upgrade to Spring Boot 3 myself, these are my findings which I hope will others:
Migrating to Spring Boot 3 and Spring Security 6 (Servlet)
Step 1 - Update to latest Spring Boot 3 and Spring Security 5.8
As documented on the Spring Boot 3 Migration Guide, the first thing to do is update to the latest of Spring Boot 2 and use Spring Security 5.8. As shown in this commit, this involves updating your dependencies (gradle shown):
After doing this, you'll notice deprecation warnings regarding the
authorizeRequests
andmvcMatchers
usage in theSecurityConfig
. We can change this to useauthorizeHttpRequests
and userequestMatcher
:The application should now compile without warnings, and running it should demonstrate the protected endpoints.
Step 2 - Update to Spring Boot 3
Now we can update to Spring Boot 3, which involves a few things:
Update to latest Gradle
Update your gradle version to the latest of v7. If you don't do this, you may encounter errors related to building a jar when trying to run.
Update dependencies and source level
Update your dependency to use spring boot 3 (and make sure to remove the Spring Security version override if you followed the step above!):
Add
@Configuration
annotation toSecurityConfig
Make sure to add the
@Configuration
annotation to theSecurityConfig
class. Not doing this will cause the customjwtDecoder
bean to not get injected (the annotation should probably have always been there, but something in Spring Boot 3 seems to have made it required).Run with Java 17!
If you followed the above steps, you should be able to run the sample. Note that Spring Boot 3 requires Java 17, and the application will fail to start if using a non-compatible java runtime.
Migrating to Spring Boot 3 and Spring Security 6 (WebFlux)
Updating the WebFlux usage for Spring Boot 3 appears to be a bit simpler, requiring the following:
@Configuration
annotation to theSecurityConfig
classAfter doing the above, you should be able to run the application using a Java 17 runtime and see that the APIs are protected based on their authorization requirements.