Trung tâm cá nhân
sách gpt4 ai đã đi

Không thể sử dụng chú thích Bảo mật Phương thức @Secured trong Spring Security

In lại 作者：行者123 更新时间：2023-12-03 07:07:35 28 4
mua khóa gpt4 Nike

我做了很多研究，对我来说一切看起来都是正确的......但我无法让它发挥作用!有人有什么想法吗？

无论我做什么，相关映射仍然对任何人公开(匿名或登录，无论他们具有什么角色)。

理想情况下，我希望所有请求都是公开的，除了那些由 @Secured() 注释的请求 - 显然只有具有特定角色的用户才被允许访问这些映射。

Liệu điều này có thể thực hiện được không?

仅供引用，作为解决方法，我当前构建了一个方法“hasRole(String role)”，该方法检查登录用户的角色，如果该方法返回 false，则抛出 NotAuthorizedException(自定义)。

用户详细信息

  @Ghi đè
  public Collection getAuthorities() {

      List grantedAuthorities = null;

      System.out.print("Account role... ");
      System.out.println(account.getRole());

      if (account.getRole().equals("USER")) {
          GrantedAuthority grantedAuthority = new SimpleGrantedAuthority("ROLE_USER");
          grantedAuthorities = Arrays.asList(grantedAuthority);
      }

      if (account.getRole().equals("ADMIN")) {
          GrantedAuthority grantedAuthorityUser = new SimpleGrantedAuthority("ROLE_USER");
          GrantedAuthority grantedAuthorityAdmin = new SimpleGrantedAuthority("ROLE_ADMIN");
          grantedAuthorities = Arrays.asList(grantedAuthorityUser, grantedAuthorityAdmin);
      }

      return grantedAuthorities;
  }

安全配置

@Cấu hình
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private AuthFailure authFailure;

    @Autowired
    private AuthSuccess authSuccess;

    @Autowired
    private EntryPointUnauthorizedHandler unauthorizedHandler;

    @Autowired
    private UserDetailsServiceImpl userDetailsService;

    /*@Autowired
    public void configAuthBuilder(AuthenticationManagerBuilder builder) throws Exception {
        builder.userDetailsService(userDetailsService);
    }*/

    @Ghi đè
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Autowired
    @Ghi đè
    public void configure(AuthenticationManagerBuilder builder) throws Exception {
        builder.userDetailsService(userDetailsService);
    }

  private CsrfTokenRepository csrfTokenRepository() {
    HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
    repository.setHeaderName("X-XSRF-TOKEN");
    return repository;
  }

    @Ghi đè
    public void configure(HttpSecurity http) throws Exception {
      http.csrf().csrfTokenRepository(csrfTokenRepository())
        .and().exceptionHandling().authenticationEntryPoint(unauthorizedHandler)
        .and().formLogin().loginPage("/login").successHandler(authSuccess).failureHandler(authFailure)
        //.and().authorizeRequests().antMatchers("/rest/**").authenticated()
        //.and().authorizeRequests().antMatchers("/**").permitAll()
        .and().addFilterAfter(new CsrfHeaderFilter(), CsrfFilter.class);;
    }

帐户 Controller 

  @Secured("ROLE_USER")
  @RequestMapping(method = RequestMethod.GET)
  public List getAllAccounts(@RequestParam(value = "mail", required = false) String mail) {

Cảm ơn!

1 Câu trả lời

您可以将 Controller 范围的安全性与 Spring HttpSecurity 结合使用。尝试将其添加到您的配置方法中:

.antMatchers("rest/accounts*").hasRole("ADMIN")

如果您希望公开任何请求(真的吗？):

.anyRequest().permitAll()

当您从任何地方访问 UserDetailsService 时，您还可以保护您的方法调用:

@Secured("ROLE_USER")
public getAllAccounts(...){...}

只有这样，您才必须使用以下内容注释您的 SecurityConfig:

@EnableGlobalMethodSecurity(securedEnabled = true)

In practice we recommend that you use method security at your service layer, to control access to your application, and do not rely entirely on the use of security constraints defined at the web-application level. URLs change and it is difficult to take account of all the possible URLs that an application might support and how requests might be manipulated. You should try and restrict yourself to using a few simple ant paths which are simple to understand. Always try to use a"deny-by-default" approach where you have a catch-all wildcard ( / or ) defined last and denying access. Security defined at the service layer is much more robust and harder to bypass, so you should always take advantage of Spring Security’s method security options.

参见:http://docs.spring.io/autorepo/docs/spring-security/4.0.0.CI-SNAPSHOT/reference/htmlsingle/#request-matching

关于java - 无法在 Spring Security 中使用 @Secured Method Security 注释，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/29275890/

28 4 0
Bài viết được đề xuất: java - 在 java 的奇怪约会
Bài viết được đề xuất: java - 简化的 Java 单行验证、赋值和返回
Bài viết được đề xuất: java - 在 Notepad++ 或 Notepad 中查看 java 类文件中的奇怪字符
Bài viết được đề xuất: java - 使用Java读取CST时区的系统时间
行者123
Hồ sơ cá nhân

Tôi là một lập trình viên xuất sắc, rất giỏi!

Nhận phiếu giảm giá Didi Taxi miễn phí
Mã giảm giá Didi Taxi
Các bài viết nóng hổi trên toàn bộ trang web
Giấy chứng nhận ICP Bắc Kinh số 000000
Hợp tác quảng cáo: 1813099741@qq.com 6ren.com