批注安全性Spring文件属性

Question

I want use annotation @PreAuthorized and @PostAuthorized in my application in spring, but I use and it not do nothing. I need activate "something" in application.properties, but I don´t know that. I read that put this is servlet.xl

 <global-method-security pre-post-annotations="enabled" />

But in file properties? I use java annotations but I haven't activate this.

Answer 1

I would suggest just to use configurations like this:

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
@EnableWebSecurity
public class AuthenticationConfiguration extends WebSecurityConfigurerAdapter {
    // Your authorisation service, you need to provide one
    @Autowired
    private UserAuthenticationService userDetailsService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests().anyRequest().fullyAuthenticated();
        http.httpBasic();
        http.csrf().disable();
    }
}

There is a pretty nice tutorial this this over here, you should read it and try to replicate it step by step, there is much more information on topic that it can be put here: Building a secure REST API with Spring Data REST and Java 8