任何人都可以深入了解@PreAuthorize 注释的工作原理吗？

Spring security 使用面向方面的编程 ( AOP ) 将安全代码编织/交织到您自己的代码库中。这在 Spring 中的工作方式是使用定义注入点的注解 (cfr. pointcuts) 以允许在您自己的代码之前/之后/内执行额外的逻辑 (cfr. advice)。

Interceptors扫描您的代码库join points（即对于 Spring，当标有特定注释时，这始终是方法执行）并将根据您使用的拦截点（即接口）执行附加的特定逻辑。

要启用此行为，可以添加配置：

@Configuration
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true, proxyTargetClass = true)
public class ConfigGlobalMethodSecurity extends GlobalMethodSecurityConfiguration {
  ...
}

特别是对于PreAuthorize，PrePostAdviceReactiveMethodInterceptor负责查找用 注释的方法PreAutorize。反过来，这将委托给PreInvocationAuthorizationAdvice这里配置的ReactiveMethodSecurityConfiguration作为ExpressionBasedPreInvocationAdvice。

这在内部使用默认表达式处理程序DefaultMethodSecurityExpressionHandler创建一个SecurityExpressionRoot. 这的实际实现SecurityExpressionRoot将定义如何PreAuthorize处理您的遗嘱中的表达式以及需要执行哪些逻辑。

该SecurityExpressionRoot定义哪些表达式是让你内PreAuthorize，如hasRole。

要添加额外的表达式或扩展默认权限逻辑，您需要提供一个自定义实现，SecurityExpressionRoot可选地自定义PermissionEvaluator. 例如，如果您想编写@PreAuthorize("hasKnowledgeOf('AOP')").

public class CustomMethodSecurityExpressionRoot
    extends SecurityExpressionRoot
    implements MethodSecurityExpressionOperations {

  private final PermissionEvaluator permissionEvaluator;
  private final Authentication authentication;

  private Object filterObject;
  private Object returnObject;
  private Object target;

  public CustomMethodSecurityExpressionRoot(
      Authentication authentication,
      PermissionEvaluator permissionEvaluator) {
    super(authentication);
    this.authentication = authentication;
    this.permissionEvaluator = permissionEvaluator;
    super.setPermissionEvaluator(permissionEvaluator);
  }

  // new expression to check if the requested knowledge is present
  public boolean hasKnowledgeOf(String context) {
    // provide logic that performs the check
  }

  @Override
  public void setFilterObject(Object filterObject) {
    this.filterObject = filterObject;
  }

  @Override
  public Object getFilterObject() {
    return filterObject;
  }

  @Override
  public void setReturnObject(Object returnObject) {
    this.returnObject = returnObject;
  }

  @Override
  public Object getReturnObject() {
    return returnObject;
  }

  @Override
  public Object getThis() {
    return target;
  }
}

和

@Configuration
public class CustomPermissionEvaluator
    implements PermissionEvaluator {

  @Override
  public boolean hasPermission(
      Authentication authentication,
      Object targetDomainObject,
      Object permission) {
    // define your custom permission logic here
  }

  @Override
  public boolean hasPermission(
      Authentication authentication,
      Serializable targetId,
      String targetType,
      Object permission) {
    // define your custom permission logic here
  }
}

完成配置并将评估器传递给表达式根。

public class CustomMethodSecurityExpressionHandler
    extends DefaultMethodSecurityExpressionHandler {

  PermissionEvaluator permissionEvaluator;

  public CustomMethodSecurityExpressionHandler(PermissionEvaluator permissionEvaluator) {
    this.permissionEvaluator = permissionEvaluator;
    super.setPermissionEvaluator(permissionEvaluator);
  }

  @Override
  protected MethodSecurityExpressionOperations createSecurityExpressionRoot(
      Authentication authentication,
      MethodInvocation invocation) {
    CustomMethodSecurityExpressionRoot root = new CustomMethodSecurityExpressionRoot(
        authentication,
        permissionEvaluator);
    root.setTrustResolver(new AuthenticationTrustResolverImpl());
    root.setRoleHierarchy(getRoleHierarchy());
    return root;
  }
}

和

@Configuration
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = true, proxyTargetClass = true)
public class ConfigGlobalMethodSecurity extends GlobalMethodSecurityConfiguration {

  @Autowired CustomPermissionEvaluator permissionEvaluator;

  @Override
  protected MethodSecurityExpressionHandler createExpressionHandler() {
    return new CustomMethodSecurityExpressionHandler(permissionEvaluator);
  }
}