Spring Security权限控制的实现接口

public enum AuthorizationInterceptorsOrder { FIRST(Integer.MIN_VALUE), /** * {@link PreFilterAuthorizationMethodInterceptor} */ PRE_FILTER, PRE_AUTHORIZE, SECURED, JSR250, POST_AUTHORIZE, /** * {@link PostFilterAuthorizationMethodInterceptor} */ POST_FILTER, LAST(Integer.MAX_VALUE); ... } 

@Configuration // 其中prepostEnabled默认true,其他注解配置默认false,需手动改为true @EnableMethodSecurity(securedEnabled = true) @RequiredArgsConstructor public class SecurityConfig { // 白名单 private static final String[] AUTH_WHITELIST = ... @Bean public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { // antMatcher or mvcMatcher http.authorizeHttpRequests() .antMatchers(AUTH_WHITELIST).permitAll() // hasRole中不需要添加 ROLE_前缀 // ant 匹配 /admin /admin/a /admin/a/b 都会匹配上 .antMatchers("/admin/**").hasRole("ADMIN") .anyRequest().authenticated(); // denyAll慎用 //                .anyRequest().denyAll(); //        http.authorizeHttpRequests() //                .mvcMatchers(AUTH_WHITELIST).permitAll() //                        // 效果同上 //                        .mvcMatchers("/admin").hasRole("ADMIN") //                        .anyRequest().denyAll(); } } 

@Api("user") @RestController @RequestMapping("/user") @RequiredArgsConstructor public class UserController { /** * {@link EnableMethodSecurity} 注解必须配置在配置类上
 * {@link PreAuthorize}等注解中表达式使用 Spring EL * @return */ @PreAuthorize("hasRole('ADMIN')") @GetMapping("/admin") public ResponseEntity> admin() { return ResponseEntity.ok(Collections.singletonMap("msg","u r admin")); } } 

public class AuthorizationFilter extends OncePerRequestFilter { // 在配置类中默认实现为 RequestMatcherDelegatingAuthorizationManager private final AuthorizationManager authorizationManager; @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { // 委托给AuthorizationManager AuthorizationDecision decision = this.authorizationManager.check(this::getAuthentication, request); if (decision != null && !decision.isGranted()) { throw new AccessDeniedException("Access Denied"); } filterChain.doFilter(request, response); } } 

public final class RequestMatcherDelegatingAuthorizationManager implements AuthorizationManager { // http.authorizeHttpRequests().antMatchers(AUTH_WHITELIST)... // SecurityFilterChain中每配置一项就会增加一个Entry // RequestMatcherEntry包含一个RequestMatcher和一个待鉴权对象，这里是AuthorizationManager private final List>> mappings; ... @Override public AuthorizationDecision check(Supplier authentication, HttpServletRequest request) { for (RequestMatcherEntry> mapping : this.mappings) { RequestMatcher matcher = mapping.getRequestMatcher(); MatchResult matchResult = matcher.matcher(request); if (matchResult.isMatch()) { AuthorizationManager manager = mapping.getEntry(); return manager.check(authentication, new RequestAuthorizationContext(request, matchResult.getVariables())); } } return null; } } 

@Configuration(proxyBeanMethods = false) @Role(BeanDefinition.ROLE_INFRASTRUCTURE) final class PrePostMethodSecurityConfiguration { private final AuthorizationManagerBeforeMethodInterceptor preAuthorizeAuthorizationMethodInterceptor; private final PreAuthorizeAuthorizationManager preAuthorizeAuthorizationManager = new PreAuthorizeAuthorizationManager(); private final DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler(); ... @Autowired PrePostMethodSecurityConfiguration(ApplicationContext context) { // 设置 Spring EL 解析器 this.preAuthorizeAuthorizationManager.setExpressionHandler(this.expressionHandler); // 拦截@PreAuthorize方法 this.preAuthorizeAuthorizationMethodInterceptor = AuthorizationManagerBeforeMethodInterceptor .preAuthorize(this.preAuthorizeAuthorizationManager); ... } ... } 

public final class AuthorizationManagerBeforeMethodInterceptor implements Ordered, MethodInterceptor, PointcutAdvisor, AopInfrastructureBean { /** * 调用起点 */ public static AuthorizationManagerBeforeMethodInterceptor preAuthorize() { // 针对 @PreAuthorize注解提供的AuthorizationManager为PreAuthorizeAuthorizationManager return preAuthorize(new PreAuthorizeAuthorizationManager()); } /** * 初始化，创建基于@PreAuthorize注解的aop方法拦截器 * Creates an interceptor for the {@link PreAuthorize} annotation * @param authorizationManager the {@link PreAuthorizeAuthorizationManager} to use * @return the interceptor */ public static AuthorizationManagerBeforeMethodInterceptor preAuthorize( PreAuthorizeAuthorizationManager authorizationManager) { AuthorizationManagerBeforeMethodInterceptor interceptor = new AuthorizationManagerBeforeMethodInterceptor( AuthorizationMethodPointcuts.forAnnotations(PreAuthorize.class), authorizationManager); interceptor.setOrder(AuthorizationInterceptorsOrder.PRE_AUTHORIZE.getOrder()); return interceptor; } ... // 实现MethodInterceptor方法，在调用实际方法是会首先触发这个 @Override public Object invoke(MethodInvocation mi) throws Throwable { // 先鉴权 attemptAuthorization(mi); // 后执行实际方法 return mi.proceed(); } private void attemptAuthorization(MethodInvocation mi) { // 判断, @PreAuthorize方法用的manager就是 // PreAuthorizeAuthorizationManager // 是通过上面的static类构造的 AuthorizationDecision decision = this.authorizationManager.check(AUTHENTICATION_SUPPLIER, mi); if (decision != null && !decision.isGranted()) { throw new AccessDeniedException("Access Denied"); } ... } static final Supplier AUTHENTICATION_SUPPLIER = () -> { Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); if (authentication == null) { throw new AuthenticationCredentialsNotFoundException( "An Authentication object was not found in the SecurityContext"); } return authentication; }; } 

public final class PreAuthorizeAuthorizationManager implements AuthorizationManager { private final PreAuthorizeExpressionAttributeRegistry registry = new PreAuthorizeExpressionAttributeRegistry(); private MethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler(); @Override public AuthorizationDecision check(Supplier authentication, MethodInvocation mi) { // 获取方法上@PreAuthorize注解中的Spring EL 表达式属性 ExpressionAttribute attribute = this.registry.getAttribute(mi); if (attribute == ExpressionAttribute.NULL_ATTRIBUTE) { return null; } // Spring EL 的 context EvaluationContext ctx = this.expressionHandler.createEvaluationContext(authentication.get(), mi); // 执行表达式中结果, 会执行SecurityExpressionRoot类中对应方法。涉及Spring EL执行原理，pass boolean granted = ExpressionUtils.evaluateAsBoolean(attribute.getExpression(), ctx); // 返回结果 return new ExpressionAttributeAuthorizationDecision(granted, attribute); } }