Spring实战—使用注解保护方法，附上spring全家桶！

尽管Spring Security为我们提供了Web层的安全保护，我们依旧有可能会疏忽而导致用户通过正常访问路径访问到不应该访问的方法，所以除了在web层实施保护以外，我们还需要给底层的方法施加保护层。这样就能保证如果用户不具备权限的话，就无法执行相应的逻辑

文末分享的一线架构师的Spring全家桶笔记：Spring+Spring Boot+Spring Cloud+Spring MVC，如果你想要一起学习那就添加小助手VX：xuanwo008免费领取不要错过哦

Spring Security 提供了三种不同的安全注解：

1. Spring Security 自带的 @Secured 注解；
2. JSR-250 的 @RolesAllowed 注解；
3. 表达式驱动的注解，包括 @PreAuthorize 、 @PostAuthorize 、 @PreFilter 和 @PostFilter 。

其中，@Secured 和 @RolesAllowed 方案非常类似，能够基于用户所授予的权限限制对方法的访问

基础环境：(详细配置解释请参考第九章文章)

 

<!--定义spring版本信息-->
<properties>
    <org.springframework.version>5.1.3.RELEASE</org.springframework.version>
    <spring.security.version>5.1.3.RELEASE</spring.security.version>
</properties>

<dependencies>
    <dependency>
        <groupId>junit</groupId>
        <artifactId>junit</artifactId>
        <version>4.12</version>
        <scope>test</scope>
    </dependency>

    <!-- servlet -->
    <dependency>
        <groupId>javax.servlet</groupId>
        <artifactId>javax.servlet-api</artifactId>
        <version>3.1.0</version>
        <scope>provided</scope>
    </dependency>

    <!-- jstl -->
    <dependency>
        <groupId>jstl</groupId>
        <artifactId>jstl</artifactId>
        <version>1.2</version>
    </dependency>

    <!--lombok引入，用于精简代码，bean类使用注解默认携带setter和getter方法等-->
    <dependency>
        <groupId>org.projectlombok</groupId>
        <artifactId>lombok</artifactId>
        <version>1.18.4</version>
    </dependency>

    <!--    Spring基础框架引入   -->
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-core</artifactId>
        <version>${org.springframework.version}</version>
    </dependency>

    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-context</artifactId>
        <version>${org.springframework.version}</version>
    </dependency>

    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-test</artifactId>
        <version>${org.springframework.version}</version>
    </dependency>

    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-aop</artifactId>
        <version>${org.springframework.version}</version>
    </dependency>

    <dependency>
        <groupId>org.aspectj</groupId>
        <artifactId>aspectjweaver</artifactId>
        <version>1.8.13</version>
    </dependency>

    <!-- Spring MVC -->
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-webmvc</artifactId>
        <version>${org.springframework.version}</version>
    </dependency>

    <!--     Spring Security依赖       -->
    <!-- https://mvnrepository.com/artifact/org.springframework.security/spring-security-core -->
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-core</artifactId>
        <version>${spring.security.version}</version>
    </dependency>

    <!-- https://mvnrepository.com/artifact/org.springframework.security/spring-security-web -->
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-web</artifactId>
        <version>${spring.security.version}</version>
    </dependency>

    <!-- https://mvnrepository.com/artifact/org.springframework.security/spring-security-com.my.spring.config -->
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-config</artifactId>
        <version>${spring.security.version}</version>
    </dependency>
</dependencies>

配置web环境

• 配置SpringMVC默认DispatcherServlet类

 

public class WebAppInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {

    private final Logger logger = LoggerFactory.