rest - 其余资源的 Grails spring-security 静态规则似乎无法正常工作

Question

我有一个使用 Spring Security 插件(版本 1.2.7.3)和安全注释方法(默认方法，更多 here)的 Grails(2.0.4)应用程序。

现在，我在 UrlMapping.groovy 中有这些带有资源键或 Controller /操作对的 URL，如下所示:

"/$controller/$action?/$id?" {
        constraints {
            // apply constraints here
        }
    }

// other rules, all working properly

"/api/item/$id?"(resource: 'itemRest')
'/api/item/batch-delete'(controller: 'itemRest', action: 'batchDelete')

RESTful 映射与 ItemRestController 完美配合:每个方法(显示、更新、保存、删除)都使用正确的 HTTP 方法正确映射。额外的方法 (batchDelete) 也能工作。

我保护了 API url，这样做:

grails.plugins.springsecurity.controllerAnnotations.staticRules = [
     // ...
     '/something/**': ['IS_AUTHENTICATED_FULLY']
     '/api/**': ['IS_AUTHENTICATED_FULLY']
]

现在，如果我打电话，我会被重定向到登录页面:

http://host/context/something/bla_bla

但如果我调用(在需要时使用适当的有效载荷):

http://host/context/api/item/batchDelete
http://host/context/api/item/1
http://host/context/api/item

我怀疑是在将 rest Controller 与资源键映射时，静态规则无法正常工作。

另请注意，UrlMapping.groovy 文件中不存在“某物”网址。

有任何想法吗？

Answer 1

我认为你必须使用

grails.plugins.springsecurity.controllerAnnotations.staticRules = [
     '/itemrest/**': ['IS_AUTHENTICATED_FULLY'],
      //this will be redundant after the above rule I guess
     '/api/**': ['IS_AUTHENTICATED_FULLY']
]

urlMapping 中未映射的 URL 必须引用 controller直接上规则。看看 warning下 controllerAnnotations.staticRules在文档中。

When mapping URLs for controllers that are mapped in UrlMappings.groovy, you need to secure the un-url-mapped URLs. For example if you have a FooBarController that you map to /foo/bar/$action, you must register that in controllerAnnotations.staticRules as /foobar/**. This is different than the mapping you would use for the other two approaches and is necessary because controllerAnnotations.staticRules entries are treated as if they were annotations on the corresponding controller.