【异常】记一次因修复漏洞扫描导致SpringSecurity出现的循环依赖问题

阿里云国内75折回扣微信号：monov8

阿里云国际，腾讯云国际，低至75折。AWS 93折免费开户实名账号代冲值优惠多多微信号：monov8 飞机：@monov6

一、循环依赖问题

APPLICATION FAILED TO START

Description:

The dependencies of some of the beans in the application context form a cycle:

┌─────┐
| springSecurityConfig (field private XXXX.config.MyauthenticationProvider XXXX.config.SpringSecurityConfig.myauthenticationProvider)
↑ ↓
| myauthenticationProvider (field private org.springframework.security.crypto.password.PasswordEncoder XXXX.config.MyauthenticationProvider.passwordEncoder)
└─────┘

Action:

Relying upon circular references is discouraged and they are prohibited by default. Update your application to remove the dependency cycle between beans. As a last resort, it may be possible to break the cycle automatically by setting spring.main.allow-circular-references to true.

进程已结束退出代码为 0

二、背景说明

最近也没有啥变更啊有的就是因为客户漏洞扫描的时候反馈了说我们的Spring框架出问题了第一直接就是SpringBoot的版本有问题要修复于是升级了版本如下这一升级好啦就出现了上面的问题了。
漏洞扫描报告

<parent>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-parent</artifactId>
      <version>2.6.7</version>
      <relativePath/>
</parent>

底层默认的Spring版本是

<spring-framework.version>5.3.19</spring-framework.version>

三、问题原因

3.1 在SpringSecurityConfig注入MyAuthenticationProvider

@Autowired
private MyAuthenticationProvider myAuthenticationProvider;

3.2 在SpringSecurityConfig声明一个BeanPasswordEncoder

@Bean
public PasswordEncoder passwordEncoder() {
     return new BCryptPasswordEncoder();
}

3.2 在MyAuthenticationProvider 又注入了PasswordEncoder

@Component
public class MyAuthenticationProvider implements AuthenticationProvider, UserDetailsService {
    @Autowired
    private UserService userService;
    @Autowired
    private UserDao userDao;
    @Autowired
    private PasswordEncoder passwordEncoder;

四、问题解决

循环引用主要是因为会导致Spring不知道该先创建哪个Bean才会被禁用的可以使用@Lazy注解指定某个Bean进行懒加载就可以优雅解决该问题。

@Component
public class MyAuthenticationProvider implements AuthenticationProvider, UserDetailsService {

    @Autowired
    private UserService userService;

    @Autowired
    private UserDao userDao;

    @Lazy
    @Autowired
    private PasswordEncoder passwordEncoder;