WebSecurityConfigurerAdapter和Res

WebSecurityConfigurerAdapter是默认情况下spring security的http配置
ResourceServerConfigurerAdapter是默认情况下spring security oauth2的http配置
WebSecurityConfigurerAdapter部分源码如下:

@Order(100)
public abstract class WebSecurityConfigurerAdapter implements WebSecurityConfigurer<WebSecurity> {
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
       ...
    }
    public void configure(WebSecurity web) throws Exception {
    }
    protected void configure(HttpSecurity http) throws Exception {
        ...
    }
    ...
}

ResourceServerConfigurerAdapter部分源码如下:

public class ResourceServerConfigurerAdapter implements ResourceServerConfigurer {

    @Override
    public void configure(ResourceServerSecurityConfigurer resources) throws Exception {
    }

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().authenticated();
    }

}

在ResourceServerProperties中，定义了它的order默认值为SecurityProperties.ACCESS_OVERRIDE_ORDER - 1;，是大于100的,即WebSecurityConfigurerAdapter的配置的拦截要优先于ResourceServerConfigurerAdapter，优先级高的http配置是可以覆盖优先级低的配置的。
某些情况下如果需要ResourceServerConfigurerAdapter的拦截优先于WebSecurityConfigurerAdapter需要在配置文件中添加

security.oauth2.resource.filter-order=99

或者重写WebSecurityConfigurerAdapter的Order配置，如下：

@Configuration
@EnableWebSecurity
@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
    ...
}