Spring Security+Spring Boot 实现对用户权限控制访问特定权限内容(基于实战项目)

我重写了hasPermission并用此方法在控制器上校验用户权限
原创实战代码，如有问题和错误留言一起交流学习
话不多说

public class MyPermissionEvaluator implements PermissionEvaluator {
    @Resource
    private UsersServiceImpl usersService;
    @Override
    public boolean hasPermission(Authentication authentication,Object targetApplication,Object targetPermissions) {
            //获取当前登陆用户
            LoginUserDetailsImpl user = (LoginUserDetailsImpl) authentication.getPrincipal();
            if(user != null) {
                List<Permission> PermissionList = usersService.getPermission(user.getUsername());
                //遍历一个用户的所有权限并且进行校验
                for (Permission PermissionList1 :PermissionList) {
                    if (targetPermissions.equals(PermissionList1.getPermission()) & targetApplication.equals(PermissionList1.getApplication())
                    ) {
                        log.info("The user poccesses this permission!");
                        return true;
                    }
                }
            }
        log.info("The user does not have this permission!");
        return false;
    }
    @Override
    public boolean hasPermission(Authentication authentication, Serializable serializable, String s, Object o) {
        return false;
    }
}

security配置

…………
 @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .antMatchers("/index.html","/login.html").permitAll()
                .anyRequest().authenticated()
            .and()
                .formLogin()
                .loginPage("/login.html")   // 登录
                .loginProcessingUrl("/auth/login")
                .failureUrl("/error.html").permitAll()
                .defaultSuccessUrl("/")
                .failureForwardUrl("/error.html")
            .and()
                .logout()
                .logoutUrl("/auth/logout")
                .invalidateHttpSession(true)
                .logoutSuccessUrl("/login.html");
        http.csrf().disable();

    }
//注册我改写过的PermissionEvaluator类
    public DefaultWebSecurityExpressionHandler webSecurityExpressionHandler(){
        DefaultWebSecurityExpressionHandler defaultWebSecurityExpressionHandler = new DefaultWebSecurityExpressionHandler();
        defaultWebSecurityExpressionHandler.setPermissionEvaluator(MyPermissionEvaluator);
        return defaultWebSecurityExpressionHandler;
    }
    public DefaultMethodSecurityExpressionHandler defaultMethodSecurityExpressionHandler(){
        DefaultMethodSecurityExpressionHandler defaultMethodSecurityExpressionHandler = new DefaultMethodSecurityExpressionHandler();
        defaultMethodSecurityExpressionHandler.setPermissionEvaluator(MyPermissionEvaluator);
        return defaultMethodSecurityExpressionHandler;
    }

关键来了，在Controller控制校验，一个小技巧处理

    @RequestMapping(value = "/application/{id}",method = {RequestMethod.DELETE},produces="application/json;charset=UTF-8")
    @ResponseBody
    @PreAuthorize("hasPermission(#参数名(自己定义的1级权限),自己定义的2级权限)")  //这里用#获取参数
    public Object deleteApplication(@PathVariable Integer id,@RequestParam("参数名")参数名类型 参数名) {
        ApplicationMapper.deleteByPrimaryKey(id);
        return GlobalResponse.success();
    }

到此就结束了，核心就是控制器中注解参数的获取，纠结了好几天，以为拿不到。