如何使@PreAuthorize具有比@Valid或@Validated具有更高的日本看病优先级

来源：蜘蛛抓取(WebSpider) 时间：2017-08-01 06:47 标签： 具有更高的防火窗厂家
I am using spring boot, and I have enabled the global method security in WebSecurityConfigurerAdapter by
@EnableGlobalMethodSecurity(prePostEnabled = true, order = Ordered.HIGHEST_PRECEDENCE)
And Below is my controller code
@PreAuthorize("hasAnyRole('admin') or principal.id == id")
@RequestMapping(value = "/{id}", method = RequestMethod.PUT)
public User updateUser(@PathVariable("id") String id,
@Valid @RequestBody
UserDto userDto)
However, when a non-admin user try to do a PUT request, the JSR303 validator will kick in before @PreAuthorize.
For example, non-admin user ended up getting something like "first name is required" instead of "access denied". But after user supplied the first name variable to pass the validator, access denied was returned.
Does anyone know how to enforce the @PreAuthorize get checked before @Valid or @Validated?
And I have to use this kind of method-level authorization instead of url-based authorization in order to perform some complex rule checking.
解决方案 For the same scenario, I have found reccomendations to implement security via spring filters.
Here is similar post :
Also, maybe a different approach - try using validation via registering a custom validator in an @InitBinder (thus skip the @valid annotation).
To access principal object in filter class:
SecurityContextImpl sci = (SecurityContextImpl)
session().getAttribute("SPRING_SECURITY_CONTEXT");
if (sci != null) {
UserDetails cud = (UserDetails) sci.getAuthentication().getPrincipal();
In this case /{id} is a path param in the URL. To access path params in filter or interceptor class:
String[] requestMappingParams =
((HandlerMethod)handler).getMethodAnnotation(RequestMapping.class).params()
for (String value : requestMappingParams) {.
本文地址： &
我使用spring启动，并且已通过启用了WebSecurityConfigurerAdapter中的全局方法安全性。
@EnableGlobalMethodSecurity（prePostEnabled = true ，order = Ordered.HIGHEST_PRECEDENCE）
下面是我的控制器代码
@PreAuthorize（“hasAnyRole（'admin'）or principal.id == id”） @RequestMapping（value =“/ {id}” ，method = RequestMethod.PUT） public User updateUser（@PathVariable（“id”）String id，@Valid @RequestBody UserDto userDto） {...}
</$ c但是，当非管理员用户尝试执行PUT请求时，JSR303验证器将在@PreAuthorize之前插入。 例如，非管理员用户最终得到类似“名字是必需的”而不是“访问被拒绝”。
有人知道如何在@Valid或@Validated之前强制执行@PreAuthorize get检查？
为了执行一些复杂的规则检查，我必须使用这种方法级别的授权而不是基于网址的授权。
解决方案 对于同样的情况，我发现了通过弹簧过滤器实现安全性的建议。 这是类似的职位： &
扫一扫关注官方微信

我要回帖

更多关于 具有更高的防火窗厂家 的文章

 

随机推荐