java - 如何检查方法级别的 spring 安全性

Question

我已经在 Controller 方法中实现了 spring security。

下面是我的spring security.xml

-->

<!-- URL pattern based security -->
<security:http auto-config="false" entry-point-ref="authenticationEntryPoint"
    use-expressions="true">
    <custom-filter ref="authenticationFilter" position="FORM_LOGIN_FILTER" />
    <security:intercept-url access="hasAnyRole('ROLE_ADMIN','ROLE_USER')" pattern="/common/admin/**" />
    <security:intercept-url pattern="/common/accounting/**" access="hasRole('ROLE_USER')" />
    <security:logout logout-url="/j_spring_security_logout" invalidate-session="true" logout-success-url="/login"/>

</security:http>

下面是我的 Controller

@Secured({"ROLE_ADMIN"})
@RequestMapping(value = "/common/admin/addAdmin", method = RequestMethod.GET)
public String add(ModelMap map) {
    map.addAttribute(new Administrator());
    return "/common/admin/addAdmin";
}

@Secured({"ROLE_ADMIN"})
@RequestMapping(value = "/common/admin/addAdmin", method = RequestMethod.POST)
public String processadd(
        @ModelAttribute("administrator") Administrator administrator) {
    this.administratorManager.addAdmin(administrator);
    return "/common/admin/success";
}

我允许 url/common/admin/** 用于管理员和用户角色。但是我在管理 Controller 中做了一些限制。当用户以用户角色进入/common/admin/* 时，他可以，但他也可以进入仅适用于管理员角色的方法。

我该如何解决？

谢谢!

Answer 1

您已经添加了 @Secured 注释。

但你需要启用它:

<!-- secured-annotations = (@Secured("ROLE_ADMIN")) -->
<!-- jsr250-annotations = (@RunAs @RolesAllowed @PermitAll @DenyAll @DeclareRoles) -->
<!-- pre-post-annotations = @PreAuthorized("hasAuthority('ROLE_ADMIN')") -->
<global-method-security
    secured-annotations="enabled" 
    jsr250-annotations="disabled"
    pre-post-annotations="disabled">        
</global-method-security>

@Secured 可以承担一个或多个角色。

• @Secured("ROLE_USER")
• @Secured({"ROLE_USER", "ROLE_ADMIN"})//如果用户具有此角色之一，则授予访问权限

BWT:来自 Spring Security 3 Book (http://www.springsecuritybook.com/):

The @Secured annotation is functionallz and syntactiallz the same as @RollesAllowed ... As @Secured functions the same as the JSR standard @RollesAllowed there's not reallz a compelling reason to use it (@Secured) in in new code...

(不要忘记启用它 jsr250-annotations="enabled")