Spring Security ,注解@secured不起作用

w9apscun  于 2021-09-29  发布在  Java
关注(0)|答案(2)|浏览(447)

我正在使用SpringMVC。
@secured注解不起作用。
我尝试了很多选择,但似乎没有任何效果。告诉我,我做错了什么?
我正在看这个页面-spring安全,方法安全注解(@securied)不起作用(java配置),它对我没有帮助。
. . .
这是我的github代码。https://github.com/mytestperson/securede
个人类

@Controller
    public class Personal {

        @GetMapping(value = "/personal")
        public ModelAndView personalGet () {

            ModelAndView modelAndView = new ModelAndView("/personal");

            modelAndView.addObject("msg", myMsg());

            return modelAndView;

        }

        @Secured(value = {"ROLE_ADMIN"})
        private String myMsg() {

            return "Hello USER!!!";

        }

    }

securityconfig.class

@EnableWebSecurity
    public class SecurityConfig extends WebSecurityConfigurerAdapter {

        @Autowired
        UserDetailsService userDetailsService;

        @Autowired
        public void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.userDetailsService(userDetailsService).passwordEncoder(new BCryptPasswordEncoder());
        }

        @Override
        protected void configure(HttpSecurity http) throws Exception {

            http

                    .authorizeRequests()
                    .mvcMatchers("/").permitAll()
                    .mvcMatchers("/personal/**").hasAnyRole("ADMIN","USER")
                    .mvcMatchers("/login").anonymous()
                    .anyRequest()
                    .authenticated()

                    .and()
                    .formLogin()

                    .and()
                    .logout()
                    .logoutUrl("/logout")
                    .logoutSuccessUrl("/")
                    .deleteCookies("JSESSIONID")
                    .invalidateHttpSession(true);

        }

    }

rootconfig.class

@EnableWebMvc
    @Configuration
    @ComponentScan("com.securede.security")
    @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
    public class RootConfig implements WebMvcConfigurer {

        @Bean
        public PasswordEncoder encoder() {
            return new BCryptPasswordEncoder();
        }
    }

userdetail.class

@Service
    public class UserDetail implements UserDetailsService {

        @Autowired
        PasswordEncoder passwordEncoder;

        @Override
        public UserDetails loadUserByUsername(String email) throws UsernameNotFoundException {

            return new org.springframework.security.core.userdetails.User(
                    "user",
                    passwordEncoder.encode("user"),
                    true,
                    true,
                    true,
                    true,
                    getAuthorities());
        }

        private Collection<? extends GrantedAuthority> getAuthorities(){

            List<SimpleGrantedAuthority> authList = new ArrayList<>();
            authList.add(new SimpleGrantedAuthority("ROLE_USER"));

            return authList;

        }

    }
xwbd5t1u

xwbd5t1u1#

当您在调用安全方法时

modelAndView.addObject("msg", myMsg());

实际上,您正在调用本地方法(就像在调用 this.myMsg() ),完全绕过spring security的注解处理。
如果你移动鼠标,你就能实现你的目标 myMsg() 方法到服务层(即 UserDetailsService ),将其注入控制器,然后调用该方法:

@Controller
public class Personal {

    @Autowired
    UserDetailsService userDetailsService;

    @GetMapping(value = "/personal")
    public ModelAndView personalGet () {

        ModelAndView modelAndView = new ModelAndView("/personal");
        modelAndView.addObject("msg", userDetailsService.myMsg());
        return modelAndView;

    }

}
v8wbuo2f

v8wbuo2f2#

为了实现你想要的,你也可以使用 @PreAuthorization 注解以及控制器方法级别上的注解。例子:

@PreAuthorization("hasRole('ROLE_ADMIN')") 
@GetMapping(value = "/personal")
public ModelAndView personalGet () {..}

spring不能在私有方法上应用基于注解的逻辑。

相关问题