This method cannot decide whether these patterns are Spring MVC patterns or not 오류 해결

기존 코드

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {

    @Bean
    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers("/usr/register").permitAll() // 문제 발생
                        .requestMatchers("/usr/login").anonymous()
                        .anyRequest().authenticated())
                ...
                .build();
    }
    
    ...
    
}

---

수정한 코드1

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {

    @Bean
    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers(new AntPathRequestMatcher("/usr/register")).permitAll()
                        .requestMatchers(new AntPathRequestMatcher("/usr/login")).anonymous()
                        .anyRequest().authenticated())
                ...
                .build();
    }
    
    ...
    
}

 

수정한 코드2

import static org.springframework.security.web.util.matcher.AntPathRequestMatcher.antMatcher;

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {

    @Bean
    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers(antMatcher("/usr/register")).permitAll()
                        .requestMatchers(antMatcher("/usr/login")).anonymous()
                        .anyRequest().authenticated())
                ...
                .build();
    }
    
    ...
    
}

---

참고 자료

https://spring.io/security/cve-2023-34035

CVE-2023-34035: Authorization rules can be misconfigured when using multiple servlets

https://marco.dev/spring-boot-h2-error

Spring Boot 3.1.2: This method cannot decide ... error | Marco Molteni