Spring Security(十七):5.8 Method Security

本文内容纲要:

- 5.8.1 EnableGlobalMethodSecurity

- 5.8.2 GlobalMethodSecurityConfiguration

From version 2.0 onwards Spring Security has improved support substantially for adding security to your service layer methods. It provides support for JSR-250 annotation security as well as the framework’s original @Secured annotation. From 3.0 you can also make use of new expression-based annotations. You can apply security to a single bean, using the intercept-methods element to decorate the bean declaration, or you can secure multiple beans across the entire service layer using the AspectJ style pointcuts.

从版本2.0开始,Spring Security大大提高了对服务层方法的安全性的支持。它为JSR-250注释安全性以及框架的原始@Secured注释提供支持。从3.0开始,您还可以使用基于表达式的新注释。您可以将安全性应用于单个bean,使用intercept-methods元素来装饰bean声明,或者可以使用AspectJ样式切入点在整个服务层中保护多个bean。

5.8.1 EnableGlobalMethodSecurity

We can enable annotation-based security using the @EnableGlobalMethodSecurity annotation on any @Configuration instance. For example, the following would enable Spring Security’s @Secured annotation.

我们可以在任何@Configuration实例上使用@EnableGlobalMethodSecurity批注启用基于注释的安全性。例如,以下内容将启用Spring Security的@Secured注释。

@EnableGlobalMethodSecurity(securedEnabled = true)

public class MethodSecurityConfig {

// ...

}

Adding an annotation to a method (on a class or interface) would then limit the access to that method accordingly. Spring Security’s native annotation support defines a set of attributes for the method. These will be passed to the AccessDecisionManager for it to make the actual decision:

然后,在方法(类或接口)上添加注释会相应地限制对该方法的访问。 Spring Security的本机注释支持为该方法定义了一组属性。这些将传递给AccessDecisionManager,以便做出实际决定:

public interface BankService {

@Secured("IS_AUTHENTICATED_ANONYMOUSLY")

public Account readAccount(Long id);

@Secured("IS_AUTHENTICATED_ANONYMOUSLY")

public Account[] findAccounts();

@Secured("ROLE_TELLER")

public Account post(Account account, double amount);

}

Support for JSR-250 annotations can be enabled using

可以使用支持JSR-250注释

@EnableGlobalMethodSecurity(jsr250Enabled = true)

public class MethodSecurityConfig {

// ...

}

These are standards-based and allow simple role-based constraints to be applied but do not have the power Spring Security’s native annotations. To use the new expression-based syntax, you would use

这些是基于标准的,允许应用简单的基于角色的约束,但没有Spring Security的本机注释功能。要使用新的基于表达式的语法,您可以使用

@EnableGlobalMethodSecurity(prePostEnabled = true)

public class MethodSecurityConfig {

// ...

}

and the equivalent Java code would be

和等效的Java代码

public interface BankService {

@PreAuthorize("isAnonymous()")

public Account readAccount(Long id);

@PreAuthorize("isAnonymous()")

public Account[] findAccounts();

@PreAuthorize("hasAuthority('ROLE_TELLER')")

public Account post(Account account, double amount);

}

5.8.2 GlobalMethodSecurityConfiguration

Sometimes you may need to perform operations that are more complicated than are possible with the @EnableGlobalMethodSecurity annotation allow. For these instances, you can extend the GlobalMethodSecurityConfiguration ensuring that the @EnableGlobalMethodSecurity annotation is present on your subclass. For example, if you wanted to provide a custom MethodSecurityExpressionHandler, you could use the following configuration:

有时您可能需要执行比@EnableGlobalMethodSecurity批注允许更复杂的操作。对于这些实例,您可以扩展GlobalMethodSecurityConfiguration,确保子类上存在@EnableGlobalMethodSecurity批注。例如,如果要提供自定义MethodSecurityExpressionHandler,可以使用以下配置:

@EnableGlobalMethodSecurity(prePostEnabled = true)

public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {

@Override

protected MethodSecurityExpressionHandler createExpressionHandler() {

// ... create and return custom MethodSecurityExpressionHandler ...

return expressionHandler;

}

}

For additional information about methods that can be overridden, refer to the GlobalMethodSecurityConfiguration Javadoc.

有关可以覆盖的方法的其他信息,请参阅GlobalMethodSecurityConfiguration Javadoc。

本文内容总结:5.8.1 EnableGlobalMethodSecurity,5.8.2 GlobalMethodSecurityConfiguration,

原文链接:https://www.cnblogs.com/shuaiandjun/p/10134357.html

以上是 Spring Security(十七):5.8 Method Security 的全部内容, 来源链接: utcz.com/z/296439.html

回到顶部