Question

所以我基本上有一个带有PreAuthorize注释的控制器方法。默认情况下，该方法将返回所有项目。方法签名还包括可选的查询字符串（空白查询意味着检索所有记录）。问题是如果登录用户只应查看/管理他/她自己的记录，则查询字符串需要在其中包含一个过滤器，例如“clientId：2”。现在要做到这一点，我正在考虑使用Principal对象来检索登录用户并检查他/她是否也是客户端，然后我通过向其添加所需的过滤器来更新查询。我不确定这是否是解决此类问题的最佳方法。

@PreAuthorize("hasAuthority('MANAGE_ALL') OR hasAuthority('VIEW_ALL') OR hasAuthority('MANAGE_OWN')")
@RequestMapping(value = "/projects", method = RequestMethod.GET)
public ResponseEntity<RestResponse> list(Principal principal, @RequestParam(value = "query", required = false, defaultValue = "") String query) {

//If a client is logged in, he/she will have the MANAGE_OWN authority so will need to update the query string to include clientId:<logged-in-client-id>

Answer 1

我宁愿将@PreAuthorize移动到应用程序服务。

class SomeApplicationService {

     UserService userService;
     SecurityService securityService;

     @PreAuthorize("hasAuthority('MANAGE_ALL') OR hasAuthority('VIEW_ALL') OR  hasAuthority('MANAGE_OWN')")
     public List<Project> getProjects(String clientId) {
        User currentUser = userService.getLoggedInUser();
        if(securityService.canManageAllProjects(currentUser))
            //get all projects or projects of clientId
        else if(securityService.canManageOwnProjects(currentUser))
            //get own projects, ignore clientId
     }

}

Spring安全性基于角色的授权最佳实践

1 个答案: