[SpringBoot] Cannot resolve method 'antMatchers' in 'ExpressionInterceptUrlRegistry'

SpringSecurity관련 config 작성시 에러 1

새로 공부삼아 진행해보던 프로젝트에서, 이전에 진행했던 프로젝트를 참고하여 SpringSecurity관련 config 코드 작성 중에 아래의 코드에서 에러가 발생하였다.

package com.saeahga.community.config;

import com.saeahga.community.handler.LoginFailureHandler;
import lombok.RequiredArgsConstructor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@RequiredArgsConstructor
@EnableWebSecurity // Security 의 filterchain 을 구현하기 위한 어노테이션
public class SecurityConfigOrigin {
    private final LoginFailureHandler loginFailureHandler;

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/").permitAll()
                .antMatchers("/css/**").permitAll()
                .antMatchers("/js/**").permitAll()
                .antMatchers("/images/**").permitAll()
                .antMatchers("/user/**").permitAll()
                .antMatchers("/admin/**").access("hasRole('ADMIN')")
                .anyRequest().authenticated();

        return http.build();
    }
}

 

[에러]

---

원인

이전에 진행했던 프로젝트 환경

- SpringBoot: 2.7.6

- SpringSecurity: 5.7.5

 

현재 진행하는 프로젝트 환경
- SpringBoot: 3.2.0
- SpringSecurity: 6.2.0

 

 

Spring 공식 문서를 확인해보니, 먼저 authorizeRequests()가 deprecated 되었다고 한다.

또한, Spring Security 5.8 이상의 버전에서는 antMatchers, mvcMatchers, regexMatchers 메소드가 사용되지 않는다고 한다.

따라서 Spring Security 5.8 이상의 버전을 사용하는 경우에는 requestMatchers 메소드를 사용해야 한다.

 

 

[참고]

https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/config/annotation/web/builders/HttpSecurity.html#authorizeRequests()

https://stackoverflow.com/questions/28907030/spring-security-authorize-request-for-certain-url-http-method-using-httpsecu/74633151#74633151

https://github.com/spring-projects/spring-security/issues/12950

https://docs.spring.io/spring-security/reference/5.8/migration/servlet/config.html#use-new-requestmatchers

---

에러 해결

package com.saeahga.community.config;

import com.saeahga.community.handler.LoginFailureHandler;
import lombok.RequiredArgsConstructor;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@RequiredArgsConstructor
@EnableWebSecurity // Security 의 filterchain 을 구현하기 위한 어노테이션
public class SecurityConfigNew {
    private final LoginFailureHandler loginFailureHandler;

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.
                authorizeHttpRequests( authorizeHttpRequests ->
                        authorizeHttpRequests
                                .requestMatchers("/").permitAll()
                                .requestMatchers("/css/**").permitAll()
                                .requestMatchers("/js/**").permitAll()
                                .requestMatchers("/images/**").permitAll()
                                .requestMatchers("/user/**").permitAll()
                                .requestMatchers("/admin/**").hasRole("ADMIN")
                                .anyRequest().authenticated()
                );

        return http.build();
    }
}

 

SpringSecurity config 관련 또 다른 에러

[SpringBoot] ... is deprecated and marked for removal