Spring Security @PreAuthorize blocking is invalid

1. Use annotations when using spring Security, @PreAuthorize ("Hasanyrole (' Role_admin ')")

The access rights on the method are invalidated, where the configuration is as follows:

 @Configuration @enablewebsecuritypublic class Securityconfig extends    Websecurityconfigureradapter {@Autowired Userdetailsservice userdetailsservice; @Bean @Override public AuthenticationManager Authenticationmanagerbean () throws Exception {return Super.auth    Enticationmanagerbean (); } @Override protected void Configure (Authenticationmanagerbuilder auth) throws Exception {Auth.userdetailsse    Rvice (Userdetailsservice); } @Override protected void Configure (Httpsecurity http) throws Exception {http.csrf (). Disable (). Authorizerequests (). Antmatchers ("/res/**", "/login/login*"). Permitall (). Anyrequest (). Authenticated (). and (). Formlogin (). LoginPage ("/login/login"). Defaultsuccessurl ("/"). Passwordparameter ("PASSW    Ord "). Usernameparameter (" username "). and (). Logout (). Logoutsuccessurl ("/login/login "); }}

The methods in the controller are as follows:

@Controller @requestmapping ("/demo") public class Democontroller extends commoncontroller{    @Autowired    Private UserService UserService;    @PreAuthorize ("Hasanyrole (' Role_admin ')")    @RequestMapping (value = "user-list") public    void UserList () {            }}

　

Using a user without Role_admin permissions to access this method found to be invalid.

Modify:

@Override    protected void Configure (Httpsecurity http) throws Exception {        http.csrf (). Disable ()            . Authorizerequests ()            . Antmatchers ("/res/**", "/login/login*"). Permitall ()            . Antmatchers ("/demo/user-list" ). Access ("Hasrole (' Role_admin ')")            . Anyrequest (). authenticated (). and            (). Formlogin (). LoginPage ("/login/ Login "). Defaultsuccessurl ("/").                passwordparameter (" password ").                usernameparameter (" username "). and            ( ). Logout (). Logoutsuccessurl ("/login/login");    

Add on:

. Antmatchers ("/demo/user-list"). Access ("Hasrole (' Role_admin ')")

Can be intercepted normally, indicating that the method interception did not take effect.

If you are based on XML, you need to add the following in the configuration file:

<security:global-method-security
pre-post-annotations= "Enabled" proxy-target-class= "true"/>

After switching to annotation mode, you need to use @enableglobalmethodsecurity (prepostenabled=true) annotations to open.

And you need to provide the following methods:

@Bean
@Override
Public AuthenticationManager Authenticationmanagerbean () throws Exception {
return Super.authenticationmanagerbean ();
}

This will intercept normally.