GlobalMethodSecurityConfiguration is deprecated in spring boot 3，如何在3中创建Custom Expresion handler？

Question

Currently, I have created custom expression handler by overriding the createExpressionHandler function from GlobalMethodSecurityConfiguration . The code is

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class MethodSecurityConfig extends GlobalMethodSecurityConfiguration {

    Logger logger = LoggerFactory.getLogger(this.getClass());
    
    @Autowired
    private ApplicationContext applicationContext;
    
    @Override
    protected MethodSecurityExpressionHandler createExpressionHandler() {
        CustomMethodSecurityExpressionHandler expressionHandler = new CustomMethodSecurityExpressionHandler();
        expressionHandler.setPermissionEvaluator(new CustomPermissionEvaluator());
        expressionHandler.setApplicationContext(applicationContext);
        return expressionHandler;
    }
    
}

-- CustomMethodSecurityExpressionHandler class

public class CustomMethodSecurityExpressionHandler extends DefaultMethodSecurityExpressionHandler {
    
    private ApplicationContext applicationContext;
    private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();

    @Override
    protected MethodSecurityExpressionOperations createSecurityExpressionRoot(Authentication authentication,
            MethodInvocation invocation) {
        CustomMethodSecurityExpressionRoot root = new CustomMethodSecurityExpressionRoot(authentication);
        root.setPermissionEvaluator(getPermissionEvaluator());
        root.setTrustResolver(this.trustResolver);
        root.setRoleHierarchy(getRoleHierarchy());
        root.setG(this.applicationContext.getBean(CustomTraversalSource.class));
        return root;
    }
    
    //This setter method will be called from the config class
    @Override
    public void setApplicationContext(ApplicationContext applicationContext) {
        super.setApplicationContext(applicationContext);
        this.applicationContext=applicationContext;
    }
}

And CustomPermissionEvaluator

@Component
public class CustomPermissionEvaluator implements PermissionEvaluator {

    @Override
    public boolean hasPermission(Authentication authentication, Object targetDomainObject, Object permission) {
        if ((authentication == null) || (targetDomainObject == null) || !(permission instanceof String)){
            return false;
        }
        String targetType = targetDomainObject.getClass().getSimpleName().toUpperCase();
        
        return hasPrivilege(authentication, targetType, permission.toString().toUpperCase());
    }

    @Override
    public boolean hasPermission(Authentication authentication, Serializable targetId, String targetType,
            Object permission) {
        if ((authentication == null) || (targetType == null) || !(permission instanceof String)) {
            return false;
        }
        return hasPrivilege(authentication, targetType.toUpperCase(), 
          permission.toString().toUpperCase());
    }

    private boolean hasPrivilege(Authentication authentication, String targetType, String permission) {
        for (GrantedAuthority grantedAuth : authentication.getAuthorities()) {
            if (grantedAuth.getAuthority().startsWith(targetType) && 
              grantedAuth.getAuthority().contains(permission)) {
                return true;
            }
        }
        return false;
    }

}

Answer 1

@EnableMethodSecurity annotation is a recomended replacement for deprecated @EnableGlobalMethodSecurity .

Its property prePostEnabled is by default set to true .

So to enable usage of @PreAuthorize/@PostAuthorize and @PreFilter/@PostFilter which are the most widely used annotations for customizing access control on the method-level, you can apply @EnableMethodSecurity without providing any arguments.

Answer 2

Try this:

@Configuration
@RequiredArgsConstructor
public class DenyMethodSecurityConfig {
    
    private final ApplicationContext applicationContext;

    @Bean
    protected MethodSecurityExpressionHandler createExpressionHandler() {
        CustomMethodSecurityExpressionHandler expressionHandler = new CustomMethodSecurityExpressionHandler();
        expressionHandler.setPermissionEvaluator(new CustomPermissionEvaluator());
        expressionHandler.setApplicationContext(applicationContext);
        return expressionHandler;
    }
}

If you need an annotation @EnableGlobalMethodSecurity that to replace on @EnableMethodSecurity (note: prePostEnabled() default true).

If you use an annotated approach, then set this annotation above the class where you use annotations: @Pre/Post***, since incorrect work is possible if you set annotation @EnableMethodSecurity above the class that only describes the configurations (marked as @Configuration), you may observe incorrect operation of the authorization mechanism. However, I suggest you check it yourself.