自定义@PreAuthorize抛出异常security.access.AccessDeniedException: Access is denied

我不是女神ヾ 2021-08-31 22:01 886阅读 0赞

## 1.问题由来 ##

**最近在开发中使用@PreAuthorize("@el.check(‘user’)")自定义了一个验证规则，当验证通过时返回true程序没有问题，但是返回false时却抛出了异常security.access.AccessDeniedException: Access is denied**

@ApiOperation(value = "获取菜单")
        @GetMapping("getPermission")
        @PreAuthorize("@el.check('user')")
        public ResultJson  getPermission(){ 
        。。。。。。。。。
        }

**自定义规则类**

@Service(value = "el")
    public class ElPermissionConfig { 
    
        @Autowired
        RedisUtil redisUtil;
    
        public Boolean check(String ...permissions) { 
            String name=SecurityUtils.getCurrentUser();
            System.out.println(name);
            // 获取当前用户的所有权限
            SecurityUser user= (SecurityUser) redisUtil.get(name); //.getAuthorities().stream().map(GrantedAuthority::getAuthority).collect(Collectors.toList());
            List<String> elPermissions = user.getPermissionValueList();
            Boolean flag= name.equals(GlobalConstant.EMAIL_SETFROM)
                    || Arrays.stream(permissions).anyMatch(elPermissions::contains);
            
            // 判断当前用户的所有权限是否包含接口上定义的权限
            return  flag;
        }
    
    }

**部分异常报错**

4.更具token访问授权==[role, news]
    5.进行操作为=============user
    org.springframework.security.access.AccessDeniedException: 不允许访问
    	at org.springframework.security.access.vote.AffirmativeBased.decide(AffirmativeBased.java:84)
    	at org.springframework.security.access.intercept.AbstractSecurityInterceptor.beforeInvocation(AbstractSecurityInterceptor.java:233)
    	at org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor.invoke(MethodSecurityInterceptor.java:65)
    	at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
    	at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.proceed(CglibAopProxy.java:747)
    	at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:689)
    	at com.dxf.aclservice.controller.UserController$$EnhancerBySpringCGLIB$$aad74a98.save(<generated>)
    	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    	at java.lang.reflect.Method.invoke(Method.java:498)
    	at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:190)
    	at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:138)
    	at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:106)
    	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:888)
    	at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:793)
    	at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
    	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1040)
    	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:943)
    	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006)
    	at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:909)
    	at javax.servlet.http.HttpServlet.service(HttpServlet.java:660)
    	at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:883)
    	at javax.servlet.http.HttpServlet.service(HttpServlet.java:741)

## 2.解决方案 ##

**在网上找了很多方法，大多数都是  
CustomAccessDeniedHandler implements AccessDeniedHandler  
然后在 WebSecurityConfigurerAdapter 的 configure(HttpSecurity http) 方法中配置我试了下不知为什么没有效果。于是采用自己的方法：**

**2.1即在自定义验证规则类中当返回false时抛出异常**  
**if (!flag)\{  
throw new MyException(ResultCode.EXPIRED,“权限验证失败！”);  
\}**

@Service(value = "el")
    public class ElPermissionConfig { 
    
        @Autowired
        RedisUtil redisUtil;
    
        public Boolean check(String ...permissions) { 
            String name=SecurityUtils.getCurrentUser();
            System.out.println(name);
            // 获取当前用户的所有权限
            SecurityUser user= (SecurityUser) redisUtil.get(name); //.getAuthorities().stream().map(GrantedAuthority::getAuthority).collect(Collectors.toList());
            List<String> elPermissions = user.getPermissionValueList();
            Boolean flag= name.equals(GlobalConstant.EMAIL_SETFROM)
                    || Arrays.stream(permissions).anyMatch(elPermissions::contains);
            if (!flag){ 
                throw  new MyException(ResultCode.EXPIRED,"权限验证失败！");
            }
            // 判断当前用户的所有权限是否包含接口上定义的权限
            return  flag;
        }
    
    }

**2.2配置一个全局异常处理类**

@ControllerAdvice
    @Slf4j
    public class GlobalExceptionHandler { 
    
        //指定出现什么异常执行这个方法
        @ExceptionHandler(Exception.class)
        @ResponseBody //为了返回数据
        public ResultJson error(Exception e) { 
           // e.printStackTrace();
            return ResultJson.error().message("执行了全局异常处理..");
        }
        //自定义异常
        @ExceptionHandler(MyException.class)
        @ResponseBody //为了返回数据
        public ResultJson error(MyException e) { 
            log.error(e.getMsg());//@Slf4j配合打印到文件流中
            //e.printStackTrace();
            return ResultJson.error().code(e.getCode()).message(e.getMsg());
        }
    }

**这样在控制台就没有报错异常了**

{ 
        "success": false,
        "code": 40003,
        "message": "权限验证失败！",
        "data": { }
    }