Question

We are using Spring Security's ACL Annotations to allow access to certain web services. @PreAuthorize and @PostAuthorize seems to be extremely useful and favours most of the use cases we are having. The SPEL based rules on individual methods et al are helping us in fine grain security on the application and its services.

For eg:- We check the owner of a returned object as below

@PreAuthorize("hasRole('ROLE_ADMIN') and returnObject.owner == authentication.name")
public SomeDTO getSomeDTO(){ ... }

This works fine when a single object is returned. What would be the equivalent if a List is returned? How do we loop through a collection and check individual element properties in that collection using SPEL?

Answer 1

如果是收藏品，您应该使用@PreFilter和@PostFilter注释。

使用@PostFilter注释时，Spring Security会迭代通过返回的集合并删除任何元素提供的表达式是假的。名称filterObject是指集合中的当前对象。你也可以在之前过滤方法调用，使用@PreFilter，虽然这不常见要求。

请参阅下面的示例或查找更多详细信息here。

@PreAuthorize("hasRole('ROLE_ADMIN')")
@PostFilter("filterObject.owner == authentication.name")
public List<SomeDTO> getAll();

Answer 2

尝试以下表达式并查看。

@PreAuthorize("hasRole('ROLE_ADMIN') and returnObject.?[owner == authentication.name].size() == returnObject.size()")
public List<SomeDTO> getSomeDTOs(){ ... }

请参阅此post。

Answer 3

这取决于您的需求。

如果您打算从结果中过滤掉不允许的对象，则可以使用过滤掉不匹配元素的@PostFilter注释。示例（filterObject绑定到响应中的单个列表元素）：

@PostFilter("filterObject.owner == authentication.name")
public List<SomeDTO> getAll(){ ... }

如果您只想在允许所有元素的情况下返回结果，@PostFilter不会帮助您，您可以尝试使用SPEL＆＃39; {{ 1}} hasPermission注释中的函数。权限是否可以获取任何类型的对象并使用您的自定义实现（您需要编写）进行逻辑检查。例如，您可以参考this example (section 4)

How to use Spring Security @Pre and @Post annotations with collections

3 个答案: