Spring Security：@PreAuthorize僅與@RequestMapping一起使用

Question

我有一個Spring MVC控制器，並希望通過Spring Method Security來保護它。

在下面的例子它的工作原理 - @RequestMapping和@PreAuthorize註釋相同的方法：

@Controller 
public class MyController { 

    @RequestMapping(value = "/test", method = {RequestMethod.POST, RequestMethod.GET}) 
    @PreAuthorize("isAuthenticated()") 
    public ModelAndView handleRequest(HttpServletRequest request, HttpServletResponse response) throws Exception { 
     return test(request, response); 
    } 

    public ModelAndView test(HttpServletRequest request, HttpServletResponse response) throws Exception { 
     ... 
    } 

在這個例子中它不工作 - @RequestMapping和@PreAuthorize註釋不同的方法：

@Controller 
public class MyController { 

    @RequestMapping(value = "/test", method = {RequestMethod.POST, RequestMethod.GET}) 
    public ModelAndView handleRequest(HttpServletRequest request, HttpServletResponse response) throws Exception { 
     return test(request, response); 
    } 

    @PreAuthorize("isAuthenticated()") 
    public ModelAndView test(HttpServletRequest request, HttpServletResponse response) throws Exception { 
     ... 
    } 

什麼可能是這個奇怪的原因b ehaviour？

Answer 1

在第二個示例中，test方法直接從handleRequest方法中調用。 Spring沒有機制在同一個類中攔截方法調用。因此，@PreAutorize開始的代理/ AOP方法從不被調用。

More on the topic of Spring Proxy