更新：请参阅@dur的评论，它可能会解决问题，而不会有重大改变。

To make it clear, your first security configuration is correct. Your problem 
is that your filter is used as a servlet filter not only as a security chain 
filter. Spring Boot does this autmatically, if you expose your filter.

https://stackoverflow.com/a/39314867/14072498
op提到了致动器端点。我们来看看医生：https://spring.io/guides/topicals/spring-security-architecture
医生说：

If you want your application security rules to apply to the actuator 
endpoints, you can add a filter chain that is ordered earlier than the 
actuator one and that has a request matcher that includes all actuator 
endpoints.

doc建议将config分为 WebSecurityConfigurerAdapter .
在下面的配置示例中，您应该对 MainAppConfigurerAdapter .
“多Spring引导安全配置”示例：https://medium.com/@igor.bonny/multiple-spring-boot-security-configuration-c876f1b6061eSpring
要跳过其他端点的身份验证，请添加

.and()
.authorizeRequests().anyRequest().permitAll();

到应用程序链的末端，如下所示。
要验证安全设置，请为所有端点添加集成测试。

@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfiguration {

  @Configuration
  @Order(ManagementServerProperties.BASIC_AUTH_ORDER - 1)
  public class ActuatorConfigurerAdapter extends WebSecurityConfigurerAdapter {
    @Override
      protected void configure(HttpSecurity http) {
          http.antMatcher("/actuator/**")
          ...
      }
  }

  @Configuration
  @Order(SecurityProperties.DEFAULT_FILTER_ORDER)
  public class MainAppConfigurerAdapter extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) {
          http.antMatcher("/api/**")
          ...
      }
  }
}

一种方法是在安全配置和从身份验证中提取主体的自定义过滤器中使用模式。您可以按以下步骤进行：
声明忽略模式：

static final String[] IGNORE_PATTERNS = new String[] { "**/*.js", "**/*.css", "/resources/**"};

声明允许所有模式：

static final String[] PERMIT_ALL_PATTERNS = new String[] { "/login", "/logout", "/health"};

在中使用忽略的模式 WebSecurity :

web.ignoring().antMatchers(IGNORE_PATTERNS);

使用允许的所有模式 HttpSecurity :

http.authorizeRequests().antMatchers(PERMIT_ALL_PATTERNS).permitAll().anyRequest().authenticated().and() ...

宣布 RequestMatcher 在过滤器中：

List<RequestMatcher> matchers = new ArrayList<>();
 for (String pattern : IGNORE_PATTERNS) {
     matchers.add(new AntPathRequestMatcher(pattern));
 }
 for (String pattern : PERMIT_ALL_PATTERNS) {
     matchers.add(new AntPathRequestMatcher(pattern));
 }

 RequestMatcher ignoreRequestMatcher = new OrRequestMatcher(matchers);

在中使用请求匹配器 doFilter 过滤方法：

if (ignoreRequestMatcher.matches((HttpServletRequest) request)) {
 /* skip this filter */
 chain.doFilter(request, response);
 return;  } /* rest of the filter code below */

跟随https://docs.spring.io/spring-boot/docs/current/reference/html/production-ready-features.html#production-准备好端点安全，您应该：
添加到属性文件
management.endpoints.web.exposure.include包括=*
更新您的安全配置

@Configuration(proxyBeanMethods = false)
  public class ActuatorSecurity extends WebSecurityConfigurerAdapter {

  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http.requestMatcher(EndpointRequest.toAnyEndpoint()).authorizeRequests((requests) ->
          requests.anyRequest().permitAll());
      }
  }