spring - Spring Security 中带有查询参数的 URL 的 regexMatcher

Question

我应该如何在Spring Security的regexMatcher中使用这样的参数？我有许多以 /sUrl 开头且具有不同参数的 URL。此代码不起作用!

.regexMatchers("\\/sUrl\\?params=\\{url:\"reports\\/Manager\",subSystem:\"ABS\"\\}").access("hasRole('ROLE_ABS')")

Controller :

@RequestMapping(value = "sUrl", method = RequestMethod.GET)
public RedirectView sUrl(@RequestParam(name = "params") String params) {
            RedirectView redirectView = new RedirectView();
        .
        .
        .
            return redirectView;
}

当我点击此链接时，在浏览器检查器的网络分区中看到 URL:

sUrl?params={url:%22reports/Manager%22,subSystem:%22ABS%22}

Answer 1

您必须使用正则表达式 URL-encoded查询参数，参见RegexRequestMatcher :

Uses a regular expression to decide whether a supplied the URL of a supplied HttpServletRequest. Can also be configured to match a specific HTTP method. The match is performed against the servletPath + pathInfo + queryString of the request and is case-sensitive by default. Case-insensitive matching can be used by using the constructor which takes the caseInsensitive argument.

和HttpServletRequest :

Returns the query string that is contained in the request URL after the path. This method returns null if the URL does not have a query string. Same as the value of the CGI variable QUERY_STRING.

Returns:

a String containing the query string or null if the URL contains no query string. The value is not decoded by the container.

您修改后的代码:

.regexMatchers("\\/sUrl\\?params=\\{url:%22reports\\/Manager\%22,subSystem:%22ABS%22\\}").access("hasRole('ROLE_ABS')")