Spring Security（二十二）：6.4 Method Security

Posted 2021-01-28 帅S俊

From version 2.0 onwards Spring Security has improved support substantially for adding security to your service layer methods. It provides support for JSR-250 annotation security as well as the framework’s original @Secured annotation. From 3.0 you can also make use of new expression-based annotations. You can apply security to a single bean, using the intercept-methods element to decorate the bean declaration, or you can secure multiple beans across the entire service layer using the AspectJ style pointcuts.

从版本2.0开始，Spring Security大大提高了对服务层方法的安全性的支持。它为JSR-250注释安全性以及框架的原始@Secured注释提供支持。从3.0开始，您还可以使用基于表达式的新注释。您可以将安全性应用于单个bean，使用intercept-methods元素来装饰bean声明，或者可以使用AspectJ样式切入点在整个服务层中保护多个bean。

 

6.4.1 The <global-method-security> Element

This element is used to enable annotation-based security in your application (by setting the appropriate attributes on the element), and also to group together security pointcut declarations which will be applied across your entire application context. You should only declare one <global-method-security> element. The following declaration would enable support for Spring Security’s @Secured:

此元素用于在应用程序中启用基于注释的安全性（通过在元素上设置适当的属性），还可以将安全性切入点声明组合在一起，这些声明将应用于整个应用程序上下文。您应该只声??明一个<global-method-security>元素。以下声明将支持Spring Security的@Secured：

 

<global-method-security secured-annotations="enabled" />

Adding an annotation to a method (on an class or interface) would then limit the access to that method accordingly. Spring Security’s native annotation support defines a set of attributes for the method. These will be passed to the AccessDecisionManager for it to make the actual decision:

然后，在方法（类或接口）上添加注释会相应地限制对该方法的访问。 Spring Security的本机注释支持为该方法定义了一组属性。这些将传递给AccessDecisionManager，以便做出实际决定：

 

public interface BankService {

@Secured("IS_AUTHENTICATED_ANONYMOUSLY")
public Account readAccount(Long id);

@Secured("IS_AUTHENTICATED_ANONYMOUSLY")
public Account[] findAccounts();

@Secured("ROLE_TELLER")
public Account post(Account account, double amount);
}

Support for JSR-250 annotations can be enabled using

可以使用支持JSR-250注释

 

<global-method-security jsr250-annotations="enabled" />

These are standards-based and allow simple role-based constraints to be applied but do not have the power Spring Security’s native annotations. To use the new expression-based syntax, you would use

这些是基于标准的，允许应用简单的基于角色的约束，但没有Spring Security的本机注释功能。要使用新的基于表达式的语法，您可以使用

 

<global-method-security pre-post-annotations="enabled" />

and the equivalent Java code would be

和等效的Java代码

 

public interface BankService {

@PreAuthorize("isAnonymous()")
public Account readAccount(Long id);

@PreAuthorize("isAnonymous()")
public Account[] findAccounts();

@PreAuthorize("hasAuthority(‘ROLE_TELLER‘)")
public Account post(Account account, double amount);
}

Expression-based annotations are a good choice if you need to define simple rules that go beyond checking the role names against the user’s list of authorities.

如果您需要定义简单的规则，而不是根据用户的权限列表检查角色名称，那么基于表达式的注释是一个不错的选择。

 

The annotated methods will only be secured for instances which are defined as Spring beans (in the same application context in which method-security is enabled). If you want to secure instances which are not created by Spring (using the new operator, for example) then you need to use AspectJ.

只有在定义为Spring bean的实例（在启用了method-security的同一应用程序上下文中）才会保护带注释的方法。如果要保护不是由Spring创建的实例（例如，使用new运算符），则需要使用AspectJ。

 

You can enable more than one type of annotation in the same application, but only one type should be used for any interface or class as the behaviour will not be well-defined otherwise. If two annotations are found which apply to a particular method, then only one of them will be applied.

您可以在同一个应用程序中启用多种类型的注释，但是任何接口或类只应使用一种类型，否则行为将无法明确定义。如果找到适用于特定方法的两个注释，则只应用其中一个注释。

Adding Security Pointcuts using protect-pointcut（使用protect-pointcut添加安全性切入点）

The use of protect-pointcut is particularly powerful, as it allows you to apply security to many beans with only a simple declaration. Consider the following example:

使用protect-pointcut特别强大，因为它允许您只使用简单的声明将安全性应用于许多bean。请考虑以下示例：

 

<global-method-security>
<protect-pointcut expression="execution(* com.mycompany.*Service.*(..))"
	access="ROLE_USER"/>
</global-method-security>

This will protect all methods on beans declared in the application context whose classes are in the com.mycompany package and whose class names end in "Service". Only users with the ROLE_USER role will be able to invoke these methods. As with URL matching, the most specific matches must come first in the list of pointcuts, as the first matching expression will be used. Security annotations take precedence over pointcuts.

这将保护在应用程序上下文中声明的bean上的所有方法，这些bean的类在com.mycompany包中，其类名以“Service”结尾。只有具有ROLE_USER角色的用户才能调用这些方法。与URL匹配一样，最具体的匹配必须首先出现在切入点列表中，因为将使用第一个匹配表达式。安全注释优先于切入点。