我正在使用SpringMVC。
@secured注解不起作用。
我尝试了很多选择,但似乎没有任何效果。告诉我,我做错了什么?
我正在看这个页面-spring安全,方法安全注解(@securied)不起作用(java配置),它对我没有帮助。
. . .
这是我的github代码。https://github.com/mytestperson/securede
个人类
@Controller
public class Personal {
@GetMapping(value = "/personal")
public ModelAndView personalGet () {
ModelAndView modelAndView = new ModelAndView("/personal");
modelAndView.addObject("msg", myMsg());
return modelAndView;
}
@Secured(value = {"ROLE_ADMIN"})
private String myMsg() {
return "Hello USER!!!";
}
}
securityconfig.class
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Autowired
UserDetailsService userDetailsService;
@Autowired
public void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.userDetailsService(userDetailsService).passwordEncoder(new BCryptPasswordEncoder());
}
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.mvcMatchers("/").permitAll()
.mvcMatchers("/personal/**").hasAnyRole("ADMIN","USER")
.mvcMatchers("/login").anonymous()
.anyRequest()
.authenticated()
.and()
.formLogin()
.and()
.logout()
.logoutUrl("/logout")
.logoutSuccessUrl("/")
.deleteCookies("JSESSIONID")
.invalidateHttpSession(true);
}
}
rootconfig.class
@EnableWebMvc
@Configuration
@ComponentScan("com.securede.security")
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
public class RootConfig implements WebMvcConfigurer {
@Bean
public PasswordEncoder encoder() {
return new BCryptPasswordEncoder();
}
}
userdetail.class
@Service
public class UserDetail implements UserDetailsService {
@Autowired
PasswordEncoder passwordEncoder;
@Override
public UserDetails loadUserByUsername(String email) throws UsernameNotFoundException {
return new org.springframework.security.core.userdetails.User(
"user",
passwordEncoder.encode("user"),
true,
true,
true,
true,
getAuthorities());
}
private Collection<? extends GrantedAuthority> getAuthorities(){
List<SimpleGrantedAuthority> authList = new ArrayList<>();
authList.add(new SimpleGrantedAuthority("ROLE_USER"));
return authList;
}
}
2条答案
按热度按时间xwbd5t1u1#
当您在调用安全方法时
实际上,您正在调用本地方法(就像在调用
this.myMsg()
),完全绕过spring security的注解处理。如果你移动鼠标,你就能实现你的目标
myMsg()
方法到服务层(即UserDetailsService
),将其注入控制器,然后调用该方法:v8wbuo2f2#
为了实现你想要的,你也可以使用
@PreAuthorization
注解以及控制器方法级别上的注解。例子:spring不能在私有方法上应用基于注解的逻辑。