annotation.web.configurers.ExpressionUrlAuthorizationConfigurer@5a88849 to already built object

今天在做权限配置的时候遇到一个很坑的问题，其实就算解决了我也不知道什么原因咯，异常情况如下：

Caused by: java.lang.IllegalStateException: Cannot apply org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer@5a88849 to already built object
	at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.add(AbstractConfiguredSecurityBuilder.java:196) ~[spring-security-config-5.0.8.RELEASE.jar:5.0.8.RELEASE]
	at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.apply(AbstractConfiguredSecurityBuilder.java:133) ~[spring-security-config-5.0.8.RELEASE.jar:5.0.8.RELEASE]
	at org.springframework.security.config.annotation.web.builders.HttpSecurity.getOrApply(HttpSecurity.java:1467) ~[spring-security-config-5.0.8.RELEASE.jar:5.0.8.RELEASE]
	at org.springframework.security.config.annotation.web.builders.HttpSecurity.authorizeRequests(HttpSecurity.java:652) ~[spring-security-config-5.0.8.RELEASE.jar:5.0.8.RELEASE]
	at org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer.configure(ResourceServerSecurityConfigurer.java:199) ~[spring-security-oauth2-2.2.1.RELEASE.jar:na]
	at org.springframework.security.oauth2.config.annotation.web.configurers.ResourceServerSecurityConfigurer.configure(ResourceServerSecurityConfigurer.java:55) ~[spring-security-oauth2-2.2.1.RELEASE.jar:na]
	at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.configure(AbstractConfiguredSecurityBuilder.java:384) ~[spring-security-config-5.0.8.RELEASE.jar:5.0.8.RELEASE]
	at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.doBuild(AbstractConfiguredSecurityBuilder.java:330) ~[spring-security-config-5.0.8.RELEASE.jar:5.0.8.RELEASE]
	at org.springframework.security.config.annotation.AbstractSecurityBuilder.build(AbstractSecurityBuilder.java:41) ~[spring-security-config-5.0.8.RELEASE.jar:5.0.8.RELEASE]
	at org.springframework.security.config.annotation.web.builders.WebSecurity.performBuild(WebSecurity.java:292) ~[spring-security-config-5.0.8.RELEASE.jar:5.0.8.RELEASE]
	at org.springframework.security.config.annotation.web.builders.WebSecurity.performBuild(WebSecurity.java:79) ~[spring-security-config-5.0.8.RELEASE.jar:5.0.8.RELEASE]
	at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.doBuild(AbstractConfiguredSecurityBuilder.java:334) ~[spring-security-config-5.0.8.RELEASE.jar:5.0.8.RELEASE]
	at org.springframework.security.config.annotation.AbstractSecurityBuilder.build(AbstractSecurityBuilder.java:41) ~[spring-security-config-5.0.8.RELEASE.jar:5.0.8.RELEASE]
	at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.springSecurityFilterChain(WebSecurityConfiguration.java:104) ~[spring-security-config-5.0.8.RELEASE.jar:5.0.8.RELEASE]
	at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$938e7d39.CGLIB$springSecurityFilterChain$2(<generated>) ~[spring-security-config-5.0.8.RELEASE.jar:5.0.8.RELEASE]
	at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$938e7d39$$FastClassBySpringCGLIB$$dee1baa5.invoke(<generated>) ~[spring-security-config-5.0.8.RELEASE.jar:5.0.8.RELEASE]
	at org.springframework.cglib.proxy.MethodProxy.invokeSuper(MethodProxy.java:228) ~[spring-core-5.0.9.RELEASE.jar:5.0.9.RELEASE]
	at org.springframework.context.annotation.ConfigurationClassEnhancer$BeanMethodInterceptor.intercept(ConfigurationClassEnhancer.java:365) ~[spring-context-5.0.9.RELEASE.jar:5.0.9.RELEASE]
	at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration$$EnhancerBySpringCGLIB$$938e7d39.springSecurityFilterChain(<generated>) ~[spring-security-config-5.0.8.RELEASE.jar:5.0.8.RELEASE]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_101]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_101]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_101]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_101]
	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:154) ~[spring-beans-5.0.9.RELEASE.jar:5.0.9.RELEASE]
	... 21 common frames omitted

主要是在继承ResourceServerConfigurerAdapter该类重写下面的方法

public void configure(HttpSecurity http) throws Exception {
		http.authorizeRequests().anyRequest().authenticated();
	}

刚开始没注意，我的想法是反正我现在没配置需求，直接设置一个csrf变成disable就完事。

@Configuration
public class ResourceServerConfig extends ResServerConfig {


	@Override
	public void configure(HttpSecurity http) throws Exception {
		super.configure(http);
		http.csrf().disable()
			.antMatcher("/login").anonymous();
	}


}

 然后很高兴的去启动项目，结果就变成上面的情况了，顿时一脸懵逼，好吧，不知道什么情况，百度吧，弄了半天，百度上面就没几篇文章，没办法打断点自己跟吧，其实也没整怎么明白，就是发现这个配置已经被加载过了。后来就没办法了，我重写我不改变方法内容总行吧：

@Configuration
public class ResourceServerConfig extends ResServerConfig {


	@Override
	public void configure(HttpSecurity http) throws Exception {
		http.authorizeRequests().anyRequest().authenticated();
	}



}

结果一启动还真行，反正就猜一猜，是不是重写改方法要保留所有的请求都需要权限验证这句话，authorizeRequests().anyRequest().authenticated();

接下来就尝试下，重写改造如下：

@Configuration
public class ResourceServerConfig extends ResServerConfig {


	@Override
	public void configure(HttpSecurity http) throws Exception {
		super.configure(http);
		http.csrf().disable()
			.antMatcher("/login").anonymous()
			.and().authorizeRequests().anyRequest().authenticated();
	}


}

启动，问题解决。