java - URL 和方法的 spring 安全设置

Question

我有一个关于 Spring Security 的问题。我有几个页面 - A、B 和 C - 以及 4 个操作它们的 http 方法:GET、PUT、POST、DELETE。对于每个 A+GET 组合，我希望拥有 resource-Page-Method 形式的特殊权限。我该如何实现？以下代码不起作用:如果用户没有任何权限，它会允许所有用户事件执行所有操作。

@Override
protected void configure(HttpSecurity http) throws Exception { 


  RequestHeaderAuthenticationFilter siteMinderFilter = new RequestHeaderAuthenticationFilter();
  siteMinderFilter.setPrincipalRequestHeader("SM_USER");
  siteMinderFilter.setAuthenticationManager(authenticationManager());

  http.addFilter(siteMinderFilter);  


  List<HttpMethod> methods = new ArrayList<HttpMethod>();
  methods.add(HttpMethod.GET);
  methods.add(HttpMethod.POST);
  methods.add(HttpMethod.PUT);
  methods.add(HttpMethod.DELETE);

 List<String> resources = new ArrayList<String>();
 resources.add("A");
 resources.add("B");
 resources.add("C");     
 ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry = http.authorizeRequests();

 for (HttpMethod method:methods){
     for (String resource: resources){
         String auth = "resource-"+resource+"-"+method.name();
         registry.antMatchers(method, "**/"+resource+"/**")
         .hasAuthority(auth);
     }
 }

  http = registry.and();
  http.formLogin();   

}

Answer 1

过滤器不起作用的唯一原因是匹配器模式开头缺少斜杠 /:

代替这个

 registry.antMatchers(method, "**/"+resource+"/**") 

我应该写这个

 registry.antMatchers(method, "/**/"+resource+"/**")