spring security 的@Secured 标注在Controller上

创建SecuredInterceptor类继承HandlerInterceptorAdapter类

重写preHandle方法

public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { if(getLoginUrl() != null && request.getUserPrincipal() == null) { throw new ModelAndViewDefiningException(new ModelAndView("redirect:" + getLoginUrl())); } try { ServletHandlerMethodResolver methodResolver = getMethodResolver(handler); Method handlerMethod = methodResolver.resolveHandlerMethod(request); String[] secureds = getMethodSecured(handlerMethod); if(secureds == null) { return true; } if (logger.isDebugEnabled()) { logger.debug("[" + handlerMethod.getDeclaringClass() + "] method:[" + handlerMethod.getName() + "] role:" + Arrays.asList(secureds)); } for(String secured : secureds) { if(!request.isUserInRole(secured)) { if(getDenyUrl() != null) { throw new ModelAndViewDefiningException(new ModelAndView("redirect:" + getDenyUrl())); } response.sendError(HttpServletResponse.SC_FORBIDDEN,secured); return false; } } return true; } catch (NoSuchRequestHandlingMethodException ex) { response.sendError(HttpServletResponse.SC_NOT_FOUND); return false; } }

创建 RequestMappingInfo 类 重写equals和hashCode方法

private static class RequestMappingInfo { public String[] paths = new String[0]; public RequestMethod[] methods = new RequestMethod[0]; public String[] params = new String[0]; public boolean equals(Object obj) { RequestMappingInfo other = (RequestMappingInfo) obj; return (Arrays.equals(this.paths, other.paths) && Arrays.equals(this.methods, other.methods) && Arrays .equals(this.params, other.params)); } public int hashCode() { return (Arrays.hashCode(this.paths) * 29 + Arrays.hashCode(this.methods) * 31 + Arrays .hashCode(this.params)); } }

在创建 ServletHandlerMethodResolver 类 继承HandlerMethodResolver

此类用于反射Controller类中的全部方法

private class ServletHandlerMethodResolver extends HandlerMethodResolver { public ServletHandlerMethodResolver(Class<?> handlerType) { init(handlerType); } public Method resolveHandlerMethod(HttpServletRequest request) throws ServletException { String lookupPath = urlPathHelper.getLookupPathForRequest(request); Map<RequestMappingInfo, Method> targetHandlerMethods = new LinkedHashMap<RequestMappingInfo, Method>(); Map<RequestMappingInfo, String> targetPathMatches = new LinkedHashMap<RequestMappingInfo, String>(); String resolvedMethodName = null; for (Method handlerMethod : getHandlerMethods()) { RequestMappingInfo mappingInfo = new RequestMappingInfo(); RequestMapping mapping = AnnotationUtils.findAnnotation(handlerMethod, RequestMapping.class); mappingInfo.paths = mapping.value(); if (!hasTypeLevelMapping() || !Arrays.equals(mapping.method(), getTypeLevelMapping().method())) { mappingInfo.methods = mapping.method(); } if (!hasTypeLevelMapping() || !Arrays.equals(mapping.params(), getTypeLevelMapping().params())) { mappingInfo.params = mapping.params(); } boolean match = false; if (mappingInfo.paths.length > 0) { for (String mappedPath : mappingInfo.paths) { if (isPathMatch(mappedPath, lookupPath)) { if (checkParameters(mappingInfo, request)) { match = true; targetPathMatches.put(mappingInfo, mappedPath); } else { break; } } } } else { // No paths specified: parameter match sufficient. match = checkParameters(mappingInfo, request); if (match && mappingInfo.methods.length == 0 && mappingInfo.params.length == 0 && resolvedMethodName != null && !resolvedMethodName.equals(handlerMethod.getName())) { match = false; } } if (match) { Method oldMappedMethod = targetHandlerMethods.put(mappingInfo, handlerMethod); if (oldMappedMethod != null && oldMappedMethod != handlerMethod) { if (methodNameResolver != null && mappingInfo.paths.length == 0) { if (resolvedMethodName == null) { resolvedMethodName = methodNameResolver.getHandlerMethodName(request); } if (!resolvedMethodName.equals(oldMappedMethod.getName())) { oldMappedMethod = null; } if (!resolvedMethodName.equals(handlerMethod.getName())) { if (oldMappedMethod != null) { targetHandlerMethods.put(mappingInfo, oldMappedMethod); oldMappedMethod = null; } else { targetHandlerMethods.remove(mappingInfo); } } } if (oldMappedMethod != null) { throw new IllegalStateException( "Ambiguous handler methods mapped for HTTP path '" + lookupPath + "': {" + oldMappedMethod + ", " + handlerMethod + "}. If you intend to handle the same path in multiple methods, then factor " + "them out into a dedicated handler class with that path mapped at the type level!"); } } } } if (targetHandlerMethods.size() == 1) { return targetHandlerMethods.values().iterator().next(); } else if (!targetHandlerMethods.isEmpty()) { RequestMappingInfo bestMappingMatch = null; String bestPathMatch = null; for (RequestMappingInfo mapping : targetHandlerMethods.keySet()) { String mappedPath = targetPathMatches.get(mapping); if (bestMappingMatch == null) { bestMappingMatch = mapping; bestPathMatch = mappedPath; } else { if (isBetterPathMatch(mappedPath, bestPathMatch, lookupPath) || (!isBetterPathMatch(bestPathMatch, mappedPath, lookupPath) && (isBetterMethodMatch( mapping, bestMappingMatch) || (!isBetterMethodMatch(bestMappingMatch, mapping) && isBetterParamMatch( mapping, bestMappingMatch))))) { bestMappingMatch = mapping; bestPathMatch = mappedPath; } } } return targetHandlerMethods.get(bestMappingMatch); } else { throw new NoSuchRequestHandlingMethodException(lookupPath, request.getMethod(), request .getParameterMap()); } } private boolean isPathMatch(String mappedPath, String lookupPath) { if (mappedPath.equals(lookupPath) || pathMatcher.match(mappedPath, lookupPath)) { return true; } boolean hasSuffix = (mappedPath.indexOf('.') != -1); if (!hasSuffix && pathMatcher.match(mappedPath + ".*", lookupPath)) { return true; } return (!mappedPath.startsWith("/") && (lookupPath.endsWith(mappedPath) || pathMatcher.match("/**/" + mappedPath, lookupPath) || (!hasSuffix && pathMatcher.match("/**/" + mappedPath + ".*", lookupPath)))); } private boolean checkParameters(RequestMappingInfo mapping, HttpServletRequest request) { return checkRequestMethod(mapping.methods, request) && checkParameters(mapping.params, request); } private boolean checkRequestMethod(RequestMethod[] methods, HttpServletRequest request) { if (!ObjectUtils.isEmpty(methods)) { boolean match = false; for (RequestMethod method : methods) { if (method.name().equals(request.getMethod())) { match = true; } } if (!match) { return false; } } return true; } private boolean checkParameters(String[] params, HttpServletRequest request) { if (!ObjectUtils.isEmpty(params)) { for (String param : params) { int separator = param.indexOf('='); if (separator == -1) { if (param.startsWith("!")) { if (WebUtils.hasSubmitParameter(request, param.substring(1))) { return false; } } else if (!WebUtils.hasSubmitParameter(request, param)) { return false; } } else { String key = param.substring(0, separator); String value = param.substring(separator + 1); if (!value.equals(request.getParameter(key))) { return false; } } } } return true; } private boolean isBetterPathMatch(String mappedPath, String mappedPathToCompare, String lookupPath) { return (mappedPath != null && (mappedPathToCompare == null || mappedPath.equals(lookupPath) || mappedPathToCompare .length() < mappedPath.length())); } private boolean isBetterMethodMatch(RequestMappingInfo mapping, RequestMappingInfo mappingToCompare) { return (mappingToCompare.methods.length == 0 && mapping.methods.length > 0); } private boolean isBetterParamMatch(RequestMappingInfo mapping, RequestMappingInfo mappingToCompare) { return (mappingToCompare.params.length < mapping.params.length); } }

下面是俩个内部使用的工具方法

private String[] getMethodSecured(Method handlerMethod) { String[] secureds = this.methodPrivilegeCache.get(handlerMethod); if (secureds == null) { Secured s = handlerMethod.getAnnotation(Secured.class); if(s != null) { secureds = s.value(); this.methodPrivilegeCache.put(handlerMethod, secureds); } } return secureds; } private ServletHandlerMethodResolver getMethodResolver(Object handler) { Class handlerClass = ClassUtils.getUserClass(handler); ServletHandlerMethodResolver resolver = this.methodResolverCache.get(handlerClass); if (resolver == null) { resolver = new ServletHandlerMethodResolver(handlerClass); this.methodResolverCache.put(handlerClass, resolver); } return resolver; }