Question

如何限制组访问的链接，从组1的管理员无法访问组2的链接，我确实使用jwt来保护应用程序谢谢

Answer 1

我创建了一个验证服务来验证用户是否是组成员，然后我创建了一个组件来获取组名称的pathvariable。

组件代码：

@Component
@RequiredArgsConstructor
public class RequestHelper {
private final HttpServletRequest httpServletRequest;
public Object getPathVariableByName(String name) {
    final Map pathVariables = (Map) httpServletRequest.getAttribute(HandlerMapping.URI_TEMPLATE_VARIABLES_ATTRIBUTE);
    return pathVariables.get(name);
}}

anotation示例

    @PreAuthorize("hasRole('USER') and @securityServices.hasAccess(@requestHelper.getPathVariableByName('groupName')))")

服务代码示例

@Service
public class SecurityServices {


public boolean hasAccess(String groupName) {
   return true or false //acording to your case if users in the group or not 
}}

为一组用户创建受限制的链接

1 个答案: