SpringSecurity版本不一致导致序列化失败

问题

今天将springcloud.sr2升级到g版后发现zuul去auth验证信息时失败，auth报以下错误

Handling error: SerializationException, Cannot deserialize; nested exception is org.springframework.core.serializer.support.SerializationFailedException: Failed to deserialize payload. Is the byte array a result of corresponding serialization for DefaultDeserializer?; nested exception is java.io.InvalidClassException: org.springframework.security.core.authority.SimpleGrantedAuthority; local class incompatible: stream classdesc serialVersionUID = 500, local class serialVersionUID = 510

解决方案

定位到 SimpleGrantedAuthority
可以看到

private static final long serialVersionUID = SpringSecurityCoreVersion.SERIAL_VERSION_UID;

查看SERIAL_VERSION_UID
发现注释

/**
* Global Serialization value for Spring Security classes.
*
* N.B. Classes are not intended to be serializable between different versions. See
* SEC-1709 for why we still need a serial version.
*/

大致意思是SpringSecurity不支持跨版本的序列化，但是我这边的确都是用的同一版本为什么会提示不一样呢？
后来在官方issues中看到

一拍脑袋，我token存入redis中时用的是低版本的SpringSecurity，需要把redis中原有的旧token清空重新生成就可以了