java - Spring 安全。 protected 注释不起作用

Question

我有一些问题。我在我的应用程序中使用 spring security，当我标记方法注释 @Secured("ROLE_ADMIN") 时，它不起作用。

@Secured("ROLE_ADMIN")
@RequestMapping(value = "/greeting",produces = "application/json")
public @ResponseBody List<UserEntity> greeting() {
    return userService.getAllCurrentUsers();
}

这个security-config.xml

<global-method-security secured-annotations="enabled" pre-post-annotations="enabled"/>

<http pattern="/resources/**" security="none"/>
<http pattern="/loginSecurity" security="none"/>
<http pattern="/favicon.ico" security="none" />
<http use-expressions="true">
    <intercept-url pattern="/**" access="hasRole('ROLE_USER') or hasRole('ROLE_ADMIN')"/>
    <form-login login-page="/loginSecurity" default-target-url="/workspace"/>
</http>

<authentication-manager>
    <authentication-provider>
        <password-encoder hash="bcrypt" />
        <jdbc-user-service data-source-ref="dataSource"
                           authorities-by-username-query="SELECT userentity.username , roleentity.role_name from userentity
                                                    JOIN userentity_roleentity ON userentity.userid = userentity_roleentity.userlist_userid
                                                    JOIN roleentity ON userentity_roleentity.rolelist_role_name = roleentity.role_name
                                                    WHERE userentity.username = ?"
                           users-by-username-query="SELECT username,pwd,enable FROM userentity where username = ?"/>
    </authentication-provider>
</authentication-manager>

身份验证有效。数据库中的角色是正确的。此代码也有效。

sec:authorize access="hasRole('ROLE_ADMIN')">
<button onclick="loadHeadRef('workspace','settings')">
  <img src='<spring:url value="/resources/image/settings.png"/>' alt="">Settings</button>
</sec:authorize>

Answer 1

尝试使用@PreAuthorize

@PreAuthorize("hasAnyRole('ROLE_USER','ROLE_ADMIN','ROLE_APPROVAL_PENDING')")

在 spring-servlet.xml 中添加以下内容

<security:global-method-security
        pre-post-annotations="enabled" secured-annotations="enabled" />
    <mvc:annotation-driven />