我有一些问题。我在我的应用程序中使用 spring security，当我标记方法注释 @Secured("ROLE_ADMIN") 时，它不起作用。
@Secured("ROLE_ADMIN")
@RequestMapping(value = "/greeting",produces = "application/json")
public @ResponseBody List<UserEntity> greeting() {
return userService.getAllCurrentUsers();
}
这个security-config.xml
<global-method-security secured-annotations="enabled" pre-post-annotations="enabled"/>
<http pattern="/resources/**" security="none"/>
<http pattern="/loginSecurity" security="none"/>
<http pattern="/favicon.ico" security="none" />
<http use-expressions="true">
<intercept-url pattern="/**" access="hasRole('ROLE_USER') or hasRole('ROLE_ADMIN')"/>
<form-login login-page="/loginSecurity" default-target-url="/workspace"/>
</http>
<authentication-manager>
<authentication-provider>
<password-encoder hash="bcrypt" />
<jdbc-user-service data-source-ref="dataSource"
authorities-by-username-query="SELECT userentity.username , roleentity.role_name from userentity
JOIN userentity_roleentity ON userentity.userid = userentity_roleentity.userlist_userid
JOIN roleentity ON userentity_roleentity.rolelist_role_name = roleentity.role_name
WHERE userentity.username = ?"
users-by-username-query="SELECT username,pwd,enable FROM userentity where username = ?"/>
</authentication-provider>
</authentication-manager>
身份验证有效。数据库中的角色是正确的。 此代码也有效。
sec:authorize access="hasRole('ROLE_ADMIN')">
<button onclick="loadHeadRef('workspace','settings')">
<img src='<spring:url value="/resources/image/settings.png"/>' alt="">Settings</button>
</sec:authorize>
最佳答案
尝试使用@PreAuthorize
@PreAuthorize("hasAnyRole('ROLE_USER','ROLE_ADMIN','ROLE_APPROVAL_PENDING')")
在 spring-servlet.xml 中添加以下内容
<security:global-method-security
pre-post-annotations="enabled" secured-annotations="enabled" />
<mvc:annotation-driven />
关于java - Spring 安全。 protected 注释不起作用，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/28811404/