Spring Security Meta Annotation
Is it possible to build Meta Annotations of Spring Security @PreAuthorize
like for @Component
or @Qualifier
?
What I want to do is replace @PreAuthorize("hasRole('ADMIN')")
by a shortcut like @IsAdmin
. But I did not find any hint in the doc开发者_C百科umentation.
This works at least with Spring Security 3.0.2.RELEASE:
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
@PreAuthorize("hasRole('ADMIN')")
public @interface IsAdmin
{
}
Yes, it's documented in the official documentation (Spring Security 5.1) : see Method Security Meta Annotations
Example provided :
@Retention(RetentionPolicy.RUNTIME)
@PreAuthorize("#contact.name == authentication.name")
public @interface ContactPermission {}
esajs example is correct:
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
@PreAuthorize("hasRole('ADMIN')")
public @interface IsAdmin
{
}
however for some strange undocumented reason this will not work in my Spring Boot (vr 2.1.2.RELEASE) project without the proxyTargetClass
option turned on in configuration like so:
@EnableGlobalMethodSecurity(
prePostEnabled = true,
proxyTargetClass = true
)
精彩评论