Spring Security系列教程23--Spring Security的四种权限控制方式

@Overrideprotectedvoidconfigure(HttpSecurityhttp) throwsException {
http.authorizeRequests()
                .antMatchers("/admin/**")
                .hasRole("ADMIN")
                .antMatchers("/user/**")
                .hasRole("USER")
                .antMatchers("/visitor/**")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .formLogin()
                .permitAll()
                .and()
//对跨域请求伪造进行防护---->csrf:利用用户带有登录状态的cookie进行攻击的手段                .csrf()
                .disable();
    }

@Configuration@EnableGlobalMethodSecurity(prePostEnabled=true,securedEnabled=true)
publicclassSecurityConfigextendsWebSecurityConfigurerAdapter {
    ...
    ...
}

@RestControllerpublicclassUserController {
@Secured({"ROLE_USER"})
//@PreAuthorize("principal.username.equals('user')")@GetMapping("/user/hello")
publicStringhelloUser() {
return"hello, user";
    }
@PreAuthorize("hasRole('ADMIN')")
@GetMapping("/admin/hello")
publicStringhelloAdmin() {
return"hello, admin";
    }
@PreAuthorize("#age>100")
@GetMapping("/age")
publicStringgetAge(@RequestParam("age") Integerage) {
returnString.valueOf(age);
    }
@GetMapping("/visitor/hello")
publicStringhelloVisitor() {
return"hello, visitor";
    }
}

@Slf4j@RestControllerpublicclassFilterController {
/*** 只返回结果中id为偶数的user元素。* filterObject是@PreFilter和@PostFilter中的一个内置表达式，表示集合中的当前对象。*/@PostFilter("filterObject.id%2==0")
@GetMapping("/users")
publicList<User>getAllUser() {
List<User>users=newArrayList<>();
for (inti=0; i<10; i++) {
users.add(newUser(i, "yyg-"+i));
        }
returnusers;
    }
}

@Slf4j@ServicepublicclassFilterService {
/*** 当@PreFilter标注的方法内拥有多个集合类型的参数时，* 可以通过@PreFilter的filterTarget属性来指定当前是针对哪个参数进行过滤的。*/@PreFilter(filterTarget="ids", value="filterObject%2==0")
publicList<Integer>doFilter(List<Integer>ids, List<User>users) {
log.warn("ids="+ids.toString());
log.warn("users="+users.toString());
returnids;
    }
}

@Slf4j@RestControllerpublicclassFilterController {
/*** 只返回结果中id为偶数的user元素。* filterObject是@PreFilter和@PostFilter中的一个内置表达式，表示集合中的当前对象。*/@PostFilter("filterObject.id%2==0")
@GetMapping("/users")
publicList<User>getAllUser() {
List<User>users=newArrayList<>();
for (inti=0; i<10; i++) {
users.add(newUser(i, "yyg-"+i));
        }
returnusers;
    }
@AutowiredprivateFilterServicefilterService;
@GetMapping("/users2")
publicList<Integer>getUserInfos() {
List<Integer>ids=newArrayList<>();
for (inti=0; i<10; i++) {
ids.add(i);
        }
List<User>users=newArrayList<>();
for (inti=0; i<10; i++) {
users.add(newUser(i, "yyg-"+i));
        }
returnfilterService.doFilter(ids, users);
    }
}