以前，这种设置足以使用RoleHierarchy的@Secured注解。但现在不推荐使用。

@Configuration
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true, jsr250Enabled = true)
@RequiredArgsConstructor
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {

    private final RoleHierarchy roleHierarchy;
    private final RoleVoter roleVoter;
    private final AuthenticatedVoter authenticatedVoter;
    private final Jsr250Voter jsr250Voter;

    @Override
    protected AccessDecisionManager accessDecisionManager() {
        var expressionHandler = (DefaultMethodSecurityExpressionHandler) getExpressionHandler();
        expressionHandler.setRoleHierarchy(roleHierarchy);

        var expressionAdvice = new ExpressionBasedPreInvocationAdvice();
        expressionAdvice.setExpressionHandler(expressionHandler);

        return new AffirmativeBased(List.of(
                roleVoter,
                new PreInvocationAuthorizationAdviceVoter(expressionAdvice),
                authenticatedVoter,
                jsr250Voter
        ));
    }
}

字符串
The documentation说这是新的方式。但是在这种配置下。RoleHierarchy不使用@Secured注解。

@Configuration
@EnableMethodSecurity(securedEnabled = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {

    @Bean
    static MethodSecurityExpressionHandler methodSecurityExpressionHandler(RoleHierarchy roleHierarchy) {
        DefaultMethodSecurityExpressionHandler handler = new DefaultMethodSecurityExpressionHandler();
        handler.setRoleHierarchy(roleHierarchy);
        return handler;
    }
}

型
我错过了什么？