spring - 如何在 Controller 中以编程方式实现 Spring Security SpEL isFullyAuthenticated()？

Question

我有一个 Controller ，我想在其中检查用户是否与 Spring Security isFullyAuthenticated() 类似。表达式提供。我该怎么做？

我使用的解决方案基于 Tomasz Nurkiewicz 下面的回答，只是从 org.springframework.security.access.expression.SecurityExpressionRoot 窃取了实现

 public class SpringSecurityUtils {
    private static final AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();

    public static boolean isFullyAuthenticated()
    {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        return !trustResolver.isAnonymous(authentication) && !trustResolver.isRememberMe(authentication);
    }
}

Answer 1

查看 SecurityExpressionRoot 的源码和 AuthenticationTrustResolverImpl 看起来您可以使用以下条件:

public boolean isFullyAuthenticated(Authentication auth) {
    return !(auth instanceof AnonymousAuthenticationToken || 
             auth instanceof RememberMeAuthenticationToken);
}

您在哪里获得身份验证，例如使用:

SecurityContextHolder.getContext().getAuthentication()