Spring security - why does RoleVoter supports all classes and WebExpressionVoter only supports subclasses of FilterInvocation?
The secured object
is an abstract representing whatever is secured. It may be a MethodInvocation
in case of @Secured
, @RolesAllowed
, @PreFilter
and @PreAuthorize
, or a FilterInvocation
in case of <intercept-url />
or any other object if required.
The @PreFilter
and @PreAuthorize
annotations are handled by PreInvocationAuthorizationAdviceVoter
. It uses the MethodInvocation
to get the annotations and their attributes values, so it has:
public boolean supports(Class<?> clazz) {
return clazz.isAssignableFrom(MethodInvocation.class);
}
The WebExpressionVoter
is web-invocation specific, because it matches the URL to the patterns from <intercept-url />
, that's why it has:
public boolean supports(Class<?> clazz) {
return clazz.isAssignableFrom(FilterInvocation.class);
}
The RoleVoter
only uses the Authentication
object contents, so it does not depend on the secured object
, and that's why it has:
public boolean supports(Class<?> clazz) {
return true;
}
Note, that You can have a separate AccessDecisionManager
for URL level security and method level security. The first will use voters that support FilterInvocation
, and the other the ones that support MethodInvocation
. Also note that RoleVoter
supports both so it can be used in both contexts.
关键在于,得加上
public boolean supports(Class<?> clazz) {
return true;
}
![微信公众号](https://files.cnblogs.com/files/Hackerman/%E9%BB%98%E8%AE%A4%E6%A0%87%E9%A2%98_%E6%A8%AA%E7%89%88%E4%BA%8C%E7%BB%B4%E7%A0%81_2020.gif)
出处:http://www.cnblogs.com/Hackerman/