spring security中@PreAuthorize注解的使用

Posted 2022-08-17 wueryuan

添加依赖
<!-- oauth -->
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-oauth2</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security.oauth</groupId>
<artifactId>spring-security-oauth2</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-jwt</artifactId>
</dependency>

配置oauth
@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class OAuth2ResourceServerConfig extends GlobalMethodSecurityConfiguration

@Override
protected MethodSecurityExpressionHandler createExpressionHandler()

OAuth2MethodSecurityExpressionHandler oAuth2MethodSecurityExpressionHandler = new OAuth2MethodSecurityExpressionHandler();
return oAuth2MethodSecurityExpressionHandler;

/**
* 当@EnableGlobalMethodSecurity(prePostEnabled=true)的时候，@PreAuthorize可以使用
* @PreAuthorize可以用来控制一个方法是否能够被调用。
* @在controller层方法中添加权限配置(符合条件得才可以调用这个方法)
* @return
*/
@PreAuthorize(value = "#oauth2.hasAnyScope(‘A‘,‘B‘,‘C‘,‘D‘)")//添加机构编码权限，判断该机构是否有权限调用
@PreAuthorize(value="isAuthenticated()")//添加登录权限判断，登录才可以调用
public String getInformation()
return info;