一、权限管理的实现
服务端的各种资源要被SpringSecurity的权限管理控制可以通过注解和标签两种方式来处理。
放开了相关的注解后在Controller中就可以使用相关的注解来控制了
JSR250注解
/**
* JSR250
*/
@Controller
@RequestMapping("/user")
public class UserController {
@RolesAllowed(value = {"ROLE_ADMIN"})
@RequestMapping("/query")
public String query(){
System.out.println("用户查询....");
return "/home.jsp";
}
@RolesAllowed(value = {"ROLE_USER"})
@RequestMapping("/save")
public String save(){
System.out.println("用户添加....");
return "/home.jsp";
}
@RequestMapping("/update")
public String update(){
System.out.println("用户更新....");
return "/home.jsp";
}
}Spring表达式
/**
* Spring表达式
*/
@Controller
@RequestMapping("/order")
public class OrderController {
@PreAuthorize(value = "hasAnyRole('ROLE_USER')")
@RequestMapping("/query")
public String query(){
System.out.println("用户查询....");
return "/home.jsp";
}
@PreAuthorize(value = "hasAnyRole('ROLE_ADMIN')")
@RequestMapping("/save")
public String save(){
System.out.println("用户添加....");
return "/home.jsp";
}
@RequestMapping("/update")
public String update(){
System.out.println("用户更新....");
return "/home.jsp";
}
}SpringSecurity注解
@Controller
@RequestMapping("/role")
public class RoleController {
@Secured(value = "ROLE_USER")
@RequestMapping("/query")
public String query(){
System.out.println("用户查询....");
return "/home.jsp";
}
@Secured("ROLE_ADMIN")
@RequestMapping("/save")
public String save(){
System.out.println("用户添加....");
return "/home.jsp";
}
@RequestMapping("/update")
public String update(){
System.out.println("用户更新....");
return "/home.jsp";
}
}然后在页面模板文件中可以通过taglib来实现权限更细粒度的控制
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<%@ taglib prefix="security" uri="http://www.springframework.org/security/tags" %>
<html>
<head>
<title>Title</title>
</head>
<body>
<h1>HOME页面</h1>
<security:authentication property="principal.username" />
<security:authorize access="hasAnyRole('ROLE_USER')" >
<a href="#">用户查询</a><br>
</security:authorize>
<security:authorize access="hasAnyRole('RO
