spring security 的@Secured 标注在Controller上

创建SecuredInterceptor类继承HandlerInterceptorAdapter类

重写preHandle方法

 

public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
    if(getLoginUrl() != null && request.getUserPrincipal() == null) {
        throw new ModelAndViewDefiningException(new ModelAndView("redirect:" + getLoginUrl()));
    }
    try {
        ServletHandlerMethodResolver methodResolver = getMethodResolver(handler);
        Method handlerMethod = methodResolver.resolveHandlerMethod(request);
        String[] secureds = getMethodSecured(handlerMethod);
        if(secureds == null) {
            return true;
        }
        if (logger.isDebugEnabled()) {
            logger.debug("[" + handlerMethod.getDeclaringClass() + "] method:[" + handlerMethod.getName() + "] role:" + Arrays.asList(secureds));
        }
        for(String secured : secureds) {
            if(!request.isUserInRole(secured)) {
                if(getDenyUrl() != null) {
                    throw new ModelAndViewDefiningException(new ModelAndView("redirect:" + getDenyUrl()));
                }
                response.sendError(HttpServletResponse.SC_FORBIDDEN,secured);
                return false;
            }
        }
        return true;
    } catch (NoSuchRequestHandlingMethodException ex) {
        response.sendError(HttpServletResponse.SC_NOT_FOUND);
        return false;
    }
}

 

创建 RequestMappingInfo 类 重写equals和hashCode方法

 

private static class RequestMappingInfo {

    public String[] paths = new String[0];

    public RequestMethod[] methods = new RequestMethod[0];

    public String[] params = new String[0];

    public boolean equals(Object obj) {
        RequestMappingInfo other = (RequestMappingInfo) obj;
        return (Arrays.equals(this.paths, other.paths) && Arrays.equals(this.methods, other.methods) && Arrays
                .equals(this.params, other.params));
    }

    public int hashCode() {
        return (Arrays.hashCode(this.paths) * 29 + Arrays.hashCode(this.methods) * 31 + Arrays
                .hashCode(this.params));
    }
}

 

在创建 ServletHandlerMethodResolver 类 继承HandlerMethodResolver

此类用于反射Controller类中的全部方法

 

private class ServletHandlerMethodResolver extends HandlerMethodResolver {

    public ServletHandlerMethodResolver(Class<?> handlerType) {
        init(handlerType);
    }

    public Method resolveHandlerMethod(HttpServletRequest request) throws ServletException {
        String lookupPath = urlPathHelper.getLookupPathForRequest(request);
        Map<RequestMappingInfo, Method> targetHandlerMethods = new LinkedHashMap<RequestMappingInfo, Method>();
        Map<RequestMappingInfo, String> targetPathMatches = new LinkedHashMap<RequestMappingInfo, String>();
        String resolvedMethodName = null;
        for (Method handlerMethod : getHandlerMethods()) {
            RequestMappingInfo mappingInfo = new RequestMappingInfo();
            RequestMapping mapping = AnnotationUtils.findAnnotation(handlerMethod, RequestMapping.class);
            mappingInfo.paths = mapping.value();
            if (!hasTypeLevelMapping() || !Arrays.equals(mapping.method(), getTypeLevelMapping().method())) {
                mappingInfo.methods = mapping.method();
            }
            if (!hasTypeLevelMapping() || !Arrays.equals(mapping.params(), getTypeLevelMapping().params())) {
                mappingInfo.params = mapping.params();
            }
            boolean match = false;
            if (mappingInfo.paths.length > 0) {
                for (String mappedPath : mappingInfo.paths) {
                    if (isPathMatch(mappedPath, lookupPath)) {
                        if (checkParameters(mappingInfo, request)) {
                            match = true;
                            targetPathMatches.put(mappingInfo, mappedPath);
                        } else {
                            break;
                        }
                    }
                }
            } else {
                // No paths specified: parameter match sufficient.
                match = checkParameters(mappingInfo, request);
                if (match && mappingInfo.methods.length == 0 && mappingInfo.params.length == 0
                        && resolvedMethodName != null && !resolvedMethodName.equals(handlerMethod.getName())) {
                    match = false;
                }
            }
            if (match) {
                Method oldMappedMethod = targetHandlerMethods.put(mappingInfo, handlerMethod);
                if (oldMappedMethod != null && oldMappedMethod != handlerMethod) {
                    if (methodNameResolver != null && mappingInfo.paths.length == 0) {
                        if (resolvedMethodName == null) {
                            resolvedMethodName = methodNameResolver.getHandlerMethodName(request);
                        }
                        if (!resolvedMethodName.equals(oldMappedMethod.getName())) {
                            oldMappedMethod = null;
                        }
                        if (!resolvedMethodName.equals(handlerMethod.getName())) {
                            if (oldMappedMethod != null) {
                                targetHandlerMethods.put(mappingInfo, oldMappedMethod);
                                oldMappedMethod = null;
                            } else {
                                targetHandlerMethods.remove(mappingInfo);
                            }
                        }
                    }
                    if (oldMappedMethod != null) {
                        throw new IllegalStateException(
                                "Ambiguous handler methods mapped for HTTP path '"
                                        + lookupPath
                                        + "': {"
                                        + oldMappedMethod
                                        + ", "
                                        + handlerMethod
                                        + "}. If you intend to handle the same path in multiple methods, then factor "
                                        + "them out into a dedicated handler class with that path mapped at the type level!");
                    }
                }
            }
        }
        if (targetHandlerMethods.size() == 1) {
            return targetHandlerMethods.values().iterator().next();
        } else if (!targetHandlerMethods.isEmpty()) {
            RequestMappingInfo bestMappingMatch = null;
            String bestPathMatch = null;
            for (RequestMappingInfo mapping : targetHandlerMethods.keySet()) {
                String mappedPath = targetPathMatches.get(mapping);
                if (bestMappingMatch == null) {
                    bestMappingMatch = mapping;
                    bestPathMatch = mappedPath;
                } else {
                    if (isBetterPathMatch(mappedPath, bestPathMatch, lookupPath)
                            || (!isBetterPathMatch(bestPathMatch, mappedPath, lookupPath) && (isBetterMethodMatch(
                                    mapping, bestMappingMatch) || (!isBetterMethodMatch(bestMappingMatch, mapping) && isBetterParamMatch(
                                    mapping, bestMappingMatch))))) {
                        bestMappingMatch = mapping;
                        bestPathMatch = mappedPath;
                    }
                }
            }
            return targetHandlerMethods.get(bestMappingMatch);
        } else {
            throw new NoSuchRequestHandlingMethodException(lookupPath, request.getMethod(), request
                    .getParameterMap());
        }
    }

    private boolean isPathMatch(String mappedPath, String lookupPath) {
        if (mappedPath.equals(lookupPath) || pathMatcher.match(mappedPath, lookupPath)) {
            return true;
        }
        boolean hasSuffix = (mappedPath.indexOf('.') != -1);
        if (!hasSuffix && pathMatcher.match(mappedPath + ".*", lookupPath)) {
            return true;
        }
        return (!mappedPath.startsWith("/") && (lookupPath.endsWith(mappedPath)
                || pathMatcher.match("/**/" + mappedPath, lookupPath) || (!hasSuffix && pathMatcher.match("/**/"
                + mappedPath + ".*", lookupPath))));
    }

    private boolean checkParameters(RequestMappingInfo mapping, HttpServletRequest request) {
        return checkRequestMethod(mapping.methods, request) && checkParameters(mapping.params, request);
    }

    private boolean checkRequestMethod(RequestMethod[] methods, HttpServletRequest request) {
        if (!ObjectUtils.isEmpty(methods)) {
            boolean match = false;
            for (RequestMethod method : methods) {
                if (method.name().equals(request.getMethod())) {
                    match = true;
                }
            }
            if (!match) {
                return false;
            }
        }
        return true;
    }

    private boolean checkParameters(String[] params, HttpServletRequest request) {
        if (!ObjectUtils.isEmpty(params)) {
            for (String param : params) {
                int separator = param.indexOf('=');
                if (separator == -1) {
                    if (param.startsWith("!")) {
                        if (WebUtils.hasSubmitParameter(request, param.substring(1))) {
                            return false;
                        }
                    } else if (!WebUtils.hasSubmitParameter(request, param)) {
                        return false;
                    }
                } else {
                    String key = param.substring(0, separator);
                    String value = param.substring(separator + 1);
                    if (!value.equals(request.getParameter(key))) {
                        return false;
                    }
                }
            }
        }
        return true;
    }

    private boolean isBetterPathMatch(String mappedPath, String mappedPathToCompare, String lookupPath) {
        return (mappedPath != null && (mappedPathToCompare == null || mappedPath.equals(lookupPath) || mappedPathToCompare
                .length() < mappedPath.length()));
    }

    private boolean isBetterMethodMatch(RequestMappingInfo mapping, RequestMappingInfo mappingToCompare) {
        return (mappingToCompare.methods.length == 0 && mapping.methods.length > 0);
    }

    private boolean isBetterParamMatch(RequestMappingInfo mapping, RequestMappingInfo mappingToCompare) {
        return (mappingToCompare.params.length < mapping.params.length);
    }

}

 

下面是俩个内部使用的工具方法

 

private String[] getMethodSecured(Method handlerMethod) {
        String[] secureds = this.methodPrivilegeCache.get(handlerMethod);
        if (secureds == null) {
            Secured s = handlerMethod.getAnnotation(Secured.class);
            if(s != null) {
                secureds = s.value();
                this.methodPrivilegeCache.put(handlerMethod, secureds);
            }
        }
        return secureds;
    }

    private ServletHandlerMethodResolver getMethodResolver(Object handler) {
        Class handlerClass = ClassUtils.getUserClass(handler);
        ServletHandlerMethodResolver resolver = this.methodResolverCache.get(handlerClass);
        if (resolver == null) {
            resolver = new ServletHandlerMethodResolver(handlerClass);
            this.methodResolverCache.put(handlerClass, resolver);
        }
        return resolver;
    }