在Spring security

Question

<security:http entry-point-ref="casEntryPoint" use-expressions="true">

    <security:intercept-url pattern="/**" access="hasAnyRole(All roles)" />
    <security:intercept-url pattern="/unauthorized" access="hasRole('ROLE_UNAUTHORIZED')"  />
    <security:intercept-url pattern="/unauthorized" access="!hasAuthority('ROLE_SUPER_ADMIN')" />

</security:http>

我想限制来自特定角色的网址。

<security:intercept-url pattern="/unauthorized" access="!hasAuthority('ROLE_SUPER_ADMIN')" />

我试过但没有工作。

参考图片，我以管理员身份登录，但我仍可以从Url栏访问/未授权。

Answer 1

示例代码

<security:http auto-config='true' use-expressions="true">

    <security:intercept-url pattern="/unauthorized" access="hasAnyRole('ROLE_UNAUTHORIZED')"  />

    <!-- permitAll is last in order. -->
    <security:intercept-url pattern="/**" access="permitAll" />


</security:http>