Security注解：@PreAuthorize,@PostAuthorize, @Secured, EL实现方法安全

朴灿烈づ我的快乐病毒、 2021-12-19 16:23 567阅读 0赞

[Security注解：@PreAuthorize,@PostAuthorize, @Secured, EL实现方法安全][Security_PreAuthorize_PostAuthorize_ _Secured_ EL]

**![d50c7f3c-a4b3-36f8-bbee-fcdcb0d799c5.jpg][]**  
**说明**

（1）JDK版本：1.8  
（2）Spring Boot 2.0.6  
（3）Spring Security 5.0.9  
（4）Spring Data JPA 2.0.11.RELEASE  
（5）hibernate5.2.17.Final  
（6）MySQLDriver 5.1.47  
（7）MySQL 8.0.12

**需求缘起**

在之前的章节中我们介绍过通过注解的方式进行权限的控制了，这里再详细的讲解下方法级安全的几个注解。

**一、注解式方法级安全开启**

需要在WebSecuirtyConfig添加配置：

@Configuration
    @EnableWebSecurity //启用Spring Security.
    
    会拦截注解了@PreAuthrize注解的配置.
    @EnableGlobalMethodSecurity(prePostEnabled=true)
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter{
            
    
    }

**二、允许的注解**

这里主要@PreAuthorize, @PostAuthorize, @Secured这三个注解可以使用。

**2.1 @Secured**

当@EnableGlobalMethodSecurity(securedEnabled=true)的时候，@Secured可以使用：

@GetMapping("/helloUser")
    @Secured({
             "ROLE_normal","ROLE_admin"})
    public String helloUser() {
            
        return "hello,user";
    }

*说明：拥有normal或者admin角色的用户都可以方法helloUser()方法。另外需要注意的是这里匹配的字符串需要**添加前缀“ROLE\_“**。*

如果我们要求，只有同时拥有admin & noremal的用户才能方法helloUser()方法，这时候@Secured就无能为力了。

**2.2 @PreAuthorize**

Spring的 @PreAuthorize/@PostAuthorize 注解更适合方法级的安全,也支持Spring 表达式语言，提供了基于表达式的访问控制。

当@EnableGlobalMethodSecurity(prePostEnabled=true)的时候，@PreAuthorize可以使用：

@GetMapping("/helloUser")
    @PreAuthorize("hasAnyRole('normal','admin')")
    public String helloUser() {
            
        return "hello,user";
    }

*说明：拥有normal或者admin角色的用户都可以方法helloUser()方法。*

此时如果我们要求用户必须同时拥有normal和admin的话，那么可以这么编码：

@GetMapping("/helloUser")
    @PreAuthorize("hasRole('normal') AND hasRole('admin')") 
    public String helloUser() {
            
        return "hello,user";
    }

此时如果使用user/123登录的话，就无法访问helloUser()的方法了。

**2.3 @PostAuthorize**

@PostAuthorize 注解使用并不多，在方法执行后再进行权限验证，适合验证带有返回值的权限，Spring EL 提供 返回对象能够在表达式语言中获取返回的对象returnObject。

当@EnableGlobalMethodSecurity(prePostEnabled=true)的时候，@PostAuthorize可以使用：

@GetMapping("/helloUser")
    @PostAuthorize(" returnObject!=null &&  returnObject.username == authentication.name")
    public User helloUser() {
            
            Object pricipal = SecurityContextHolder.getContext().getAuthentication().getPrincipal();
            User user;
            if("anonymousUser".equals(pricipal)) {
            
                user = null;
            }else {
            
                user = (User) pricipal;
            }
            return user;
    }

这三个最常用也就是@PreAuthorize这个注解了，在使用中主要是配合Spring EL表达式。

**历史文章**

[214. Spring Security：概述][214. Spring Security]

[215.Spring Boot+Spring Security：初体验][215.Spring Boot_Spring Security]

[216.Spring Boot+Spring Security：基于内存的认证信息][216.Spring Boot_Spring Security]

[217.Spring Boot+Spring Security：基于内存的角色授权][217.Spring Boot_Spring Security]

[218.Spring Boot+Spring Security：基于内存数据库的身份认证和角色授权][218.Spring Boot_Spring Security]

[219.Spring Boot+Spring Security：基于MySQL数据库的身份认证和角色授权][219.Spring Boot_Spring Security_MySQL]

[220.Spring Boot+Spring Security:自定义登录页面和构建主页][220.Spring Boot_Spring Security]

[221.Spring Boot+Spring Security：登出和403处理][221.Spring Boot_Spring Security_403]

[222.Spring&nbsp;Boot+Spring&nbsp;Security：动态加载角色][222.Spring_nbsp_Boot_Spring_nbsp_Security]

[223.Spring&nbsp;Boot+Spring&nbsp;Security：原理1][223.Spring_nbsp_Boot_Spring_nbsp_Security_1]

[224.Spring Boot+Spring Security：自定义Filter][224.Spring Boot_Spring Security_Filter]

[246.Spring Boot+Spring Security：页面白名单和获取登录信息][246.Spring Boot_Spring Security]

[13. Spring Boot+Spring Security：基于URL动态权限n种方案][13. Spring Boot_Spring Security_URL_n]

[248.Spring Boot+Spring Security：基于URL动态权限：准备工作][248.Spring Boot_Spring Security_URL]

[249.Spring Boot+Spring Security：基于URL动态权限：扩展access()的SpEL表达式][249.Spring Boot_Spring Security_URL_access_SpEL]

[250.Spring Boot+Spring Security：基于URL动态权限：自定义AccssDesionManager][250.Spring Boot_Spring Security_URL_AccssDesionManager]

[251.Spring Boot+Spring Security：基于URL动态权限：自定义Filter][251.Spring Boot_Spring Security_URL_Filter]

[252.Spring Boot+Spring Security：标签sec:authorize的使用][252.Spring Boot_Spring Security_sec_authorize]

[253.Spring Boot+Spring Security：获取用户信息和session并发控制][253.Spring Boot_Spring Security_session]

我就是我，是颜色不一样的烟火。
    我就是我，是与众不同的小苹果。

à悟空学院：http://t.cn/Rg3fKJD

学院中有**Spring Boot**相关的课程！

SpringBoot视频：http://t.cn/R3QepWG

Spring Cloud视频：http://t.cn/R3QeRZc

SpringBoot Shiro视频：http://t.cn/R3QDMbh

SpringBoot交流平台：http://t.cn/R3QDhU0

SpringData和JPA视频：http://t.cn/R1pSojf

SpringSecurity5.0视频：http://t.cn/EwlLjHh

Sharding-JDBC分库分表实战：http://t.cn/E4lpD6e

posted on 2019-04-15 10:43 [悟纤][Link 1] 阅读( ...) 评论( ...) [编辑][Link 2] 收藏

转载于:https://www.cnblogs.com/springboot-wuqian/p/10709314.html

[Security_PreAuthorize_PostAuthorize_ _Secured_ EL]: https://www.cnblogs.com/springboot-wuqian/p/10709314.html
[d50c7f3c-a4b3-36f8-bbee-fcdcb0d799c5.jpg]: /images/20211219/aec976bc29eb49fd95da526b7bc827b7.png
[214. Spring Security]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533738&idx=1&sn=6c4c2cce84a2601944c5c48b4ffb60d6&chksm=843bbabbb34c33adfceb33cc058ef9551cf3cb432591578d40be90082021b5e2a4a6eca0811d&scene=21#wechat_redirect
[215.Spring Boot_Spring Security]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533773&idx=1&sn=58ff833ae06c5ad0e19185ff8ab4fc7d&chksm=843bbadcb34c33ca8e255b8dada084889ac109a1be770b49d37a778d039ce1c5b53e282f9169&scene=21#wechat_redirect
[216.Spring Boot_Spring Security]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533777&idx=1&sn=419777fe4cd530c67e43cc1e56ccf011&chksm=843bbac0b34c33d63dbbd1cb993bf9fcf03983248d6955ad2dcf275ebaaa046882361c2c53fc&scene=21#wechat_redirect
[217.Spring Boot_Spring Security]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533782&idx=1&sn=17d4d82dfb05d1fd278e18c6f5f44c02&chksm=843bbac7b34c33d1b7128fe58220d9f7bed162739a570f5aaacbcd95ac87793732bd1159a2a0&scene=21#wechat_redirect
[218.Spring Boot_Spring Security]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533789&idx=1&sn=79889dff3ab6afba47b36490f26d8b4a&chksm=843bbaccb34c33da1be53b3edc2595754c33b90e87022a08c18277486ebeddd08cbb8a6f3170&scene=21#wechat_redirect
[219.Spring Boot_Spring Security_MySQL]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533795&idx=1&sn=87737e5ff4efdcf7168fe0ac67b19ce9&chksm=843bbaf2b34c33e46191c13440a7362361f769a049d316905e1a76586e8d0fb53e8291b73fe0&scene=21#wechat_redirect
[220.Spring Boot_Spring Security]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533804&idx=1&sn=fd6d9b05bd44605841409fc9d8a836a3&chksm=843bbafdb34c33ebc9cbf911ce532c240d71db64015b0d356c469f34885e0b3da8f38e1804da&scene=21#wechat_redirect
[221.Spring Boot_Spring Security_403]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533813&idx=1&sn=f3f8db36b7135aeac254670c82fc7a86&chksm=843bbae4b34c33f27e10bfc4a87d80ce44f1990119ed6c81ed0762ba7602cb383bffe138ee4e&scene=21#wechat_redirect
[222.Spring_nbsp_Boot_Spring_nbsp_Security]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533835&idx=1&sn=d03093c76fb2e6f4cc95c147a5f12bba&chksm=843bbb1ab34c320cc2b654232796490583284f9ced4bd2c40cbcb49828d43d0e501773c24d37&scene=21#wechat_redirect
[223.Spring_nbsp_Boot_Spring_nbsp_Security_1]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533843&idx=1&sn=e60bc9364ee52ab26526bc982645fd9f&chksm=843bbb02b34c3214b96c8b0e9ad25ab24c1235380b8e886a13eb8f21ec83b1cd77506a3a4255&scene=21#wechat_redirect
[224.Spring Boot_Spring Security_Filter]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533847&idx=1&sn=17e787cd8610286e85f629897324c714&chksm=843bbb06b34c32108980f8d58f1071c7b7751203144e62f2f96f66f0f3b45a9cd23594cad326&scene=21#wechat_redirect
[246.Spring Boot_Spring Security]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533883&idx=1&sn=ccb64dbb9f5d7e70a411132ff3ae53ef&chksm=843bbb2ab34c323c11c64b34e8ecd90e2e4d9d35729baeda41bcec8a6b6077fe7541857b6b33&scene=21#wechat_redirect
[13. Spring Boot_Spring Security_URL_n]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533888&idx=1&sn=40f3de2cd4fef2f5e58e8183768a7e72&chksm=843bbb51b34c3247ee38b210a7e28d7e5a465b685d3a8cc6ba4fc6ea23705e273c018a149f72&scene=21#wechat_redirect
[248.Spring Boot_Spring Security_URL]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533895&idx=1&sn=540d68c7602c6bb144067815d78b6b4c&chksm=843bbb56b34c324016531d5ac2a7bd0e13644e5a89a8faec2b0208b8c3a19f15abffd3882441&scene=21#wechat_redirect
[249.Spring Boot_Spring Security_URL_access_SpEL]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533899&idx=1&sn=fa4272d828147ef2a6b5246acb724283&chksm=843bbb5ab34c324cf7392f28bd79fcf2bbd06b697f5123ca83104903c64b92b06abaaa349808&scene=21#wechat_redirect
[250.Spring Boot_Spring Security_URL_AccssDesionManager]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533903&idx=1&sn=d4a0c7024e0ab3b66cddfe447f8b100e&chksm=843bbb5eb34c32481b28bde2333bd539bae38c945ce32b5e28a13ddde44a16e237dee9896772&scene=21#wechat_redirect
[251.Spring Boot_Spring Security_URL_Filter]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533909&idx=1&sn=0cb4df975d4e1a09d06cf60342d22fa4&chksm=843bbb44b34c3252dc674b3c746e8e091bf31bd69f687b2f85f5ced5d7b48e12ad3e3c2c42f9&scene=21#wechat_redirect
[252.Spring Boot_Spring Security_sec_authorize]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533914&idx=1&sn=792bd5c96fe8fcfcb21fd93a012c480b&chksm=843bbb4bb34c325db250dd1c60c1d884837d3d96279cf25960a18fcff0498e5f5b5d93353897&scene=21#wechat_redirect
[253.Spring Boot_Spring Security_session]: http://mp.weixin.qq.com/s?__biz=MzA4ODIyMzEwMg==&mid=2447533918&idx=1&sn=8791b370c8c6b8911aa88494de0afe9b&chksm=843bbb4fb34c325998a49d59228e87bcd59bb0219054aa3b1cef264792b68c31ee23478c18ae&scene=21#wechat_redirect
[Link 1]: https://www.cnblogs.com/springboot-wuqian/
[Link 2]: https://i.cnblogs.com/EditPosts.aspx?postid=10709314