春季安全。注释安全不起作用

我有一些问题。我为我的应用程序使用spring安全性，并且当我标记方法注释@Secured（“ROLE_ADMIN”）时，它不起作用。春季安全。注释安全不起作用

@Secured("ROLE_ADMIN") 
@RequestMapping(value = "/greeting",produces = "application/json") 
public @ResponseBody List<UserEntity> greeting() { 
    return userService.getAllCurrentUsers(); 
}

此安全-config.xml中

<global-method-security secured-annotations="enabled" pre-post-annotations="enabled"/> 

<http pattern="/resources/**" security="none"/> 
<http pattern="/loginSecurity" security="none"/> 
<http pattern="/favicon.ico" security="none" /> 
<http use-expressions="true"> 
    <intercept-url pattern="/**" access="hasRole('ROLE_USER') or hasRole('ROLE_ADMIN')"/> 
    <form-login login-page="/loginSecurity" default-target-url="/workspace"/> 
</http> 

<authentication-manager> 
    <authentication-provider> 
     <password-encoder hash="bcrypt" /> 
     <jdbc-user-service data-source-ref="dataSource" 
          authorities-by-username-query="SELECT userentity.username , roleentity.role_name from userentity 
                JOIN userentity_roleentity ON userentity.userid = userentity_roleentity.userlist_userid 
                JOIN roleentity ON userentity_roleentity.rolelist_role_name = roleentity.role_name 
                WHERE userentity.username = ?" 
          users-by-username-query="SELECT username,pwd,enable FROM userentity where username = ?"/> 
    </authentication-provider> 
</authentication-manager>

认证工作。数据库中的角色是正确的。此代码也适用。

sec:authorize access="hasRole('ROLE_ADMIN')"> 
<button onclick="loadHeadRef('workspace','settings')"> 
    <img src='<spring:url value="/resources/image/settings.png"/>' alt="">Settings</button> 
</sec:authorize>

来源

2015-03-02 Denis Markov

可能重复的控制器不工作，但拦截的URL似乎工作正常]（http://stackoverflow.com/questions/6651119/secured-does-not-work-in-controller-but-intercept-url-seems-to-be-working-fine） – 2015-03-02 13:54:19

尝试在弹簧servlet.xml中使用@PreAuthorize

@PreAuthorize("hasAnyRole('ROLE_USER','ROLE_ADMIN','ROLE_APPROVAL_PENDING')")

把[@Secured以下

<security:global-method-security 
     pre-post-annotations="enabled" secured-annotations="enabled" /> 
    <mvc:annotation-driven />

来源

2015-03-02 18:49:56 LynAs

谢谢你帮助，我解决了这个问题。我把在mvc-dispatcher.xml中。 – 2015-03-04 05:22:10

不客气。然后接受答案 – LynAs 2015-03-04 05:24:07

春季安全。注释安全不起作用

回答

相关问题