hasAuthority 方法仅适用于 POST 和 PUT httpmethods

Question

这是我的配置代码片段

@Override
    public void configure(HttpSecurity http) throws Exception {
        http.
        authorizeRequests()
        .antMatchers("/").permitAll()
        .antMatchers("/api/user/**").hasAnyAuthority("ROLE_ADMIN")
        .antMatchers("/api/status/**").hasAuthority("ROLE_ADMIN").anyRequest()
        .authenticated()
        .and()
        .exceptionHandling()
        .accessDeniedHandler(new OAuth2AccessDeniedHandler());
        }

在此我需要让 ROLE_ADMIN 仅访问 POST 和 PUT http 方法。他应该无法访问 GET 或 DELETE http 方法。我需要在单个 .antMatchers() 方法中完成此操作。我该怎么做？

Answer 1

看看这个 Spring example project。您可以为每个路径和 HTTP 动词定义匹配器。

http
    .authorizeRequests()
        .antMatchers(HttpMethod.POST, "/employees").hasRole("ADMIN")
        .antMatchers(HttpMethod.PUT, "/employees/**").hasRole("ADMIN")
        .antMatchers(HttpMethod.PATCH, "/employees/**").hasRole("ADMIN")

hasAuthority 方法仅适用于 POST 和 PUT httpmethods

hasAuthority method for only POST and PUT httpmethods

spring-mvc

spring-security

spring-boot

spring-security-oauth2