0
我在我的應用程序中有兩個角色，一個角色是供訪客查看數據，另一個角色是admin。在管理頁面中，管理員可以編輯數據並在查看頁面中訪客角色可以查看數據。當我嘗試訪問URL時，我可以看到訪客和管理員的頁面視圖和管理員，但我希望訪客不應訪問管理頁面。春季安全特定用戶的訪問特定URL
以下是我的春天安全文件：
<b:beans xmlns="http://www.springframework.org/schema/security"
xmlns:b="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
<http auto-config="true" use-expressions="true">
<!-- Adds Support for basic authentication -->
<intercept-url pattern="/admin" access="hasAnyRole('ROLE_USER')" />
<!-- <http-basic /> -->
<form-login login-page="/login" authentication-failure-url="/loginFailed" default-target-url="/view" />
<logout />
</http>
<authentication-manager>
<authentication-provider>
<user-service>
<user name="leader" password="1234" authorities="ROLE_ADMIN" />
<user name="sudheer" password="1234" authorities="ROLE_USER" />
</user-service>
</authentication-provider>
</authentication-manager>
</b:beans>
而下面是我的控制器類：
@RequestMapping(value="/admin", method=RequestMethod.GET)
public ModelAndView admin(){
ModelAndView model = new ModelAndView();
List<ApplicationTO> list=application.getApplicationList();
model.addObject("applicationList", list);
model.setViewName("admin");
return model;
}
@RequestMapping(value="/view", method=RequestMethod.GET)
public ModelAndView view(){
ModelAndView model = new ModelAndView();
List<ApplicationTO> list=application.getApplicationList();
model.addObject("applicationList", list);
model.setViewName("view");
return model;
}