spring security:intercept-url pattern access="#id == 1

Question

i have project were iam spring security 3.1.3 and mvc 3.2

i want too allow a url wehen in the userid in the path is matching the principal userid

    <security:intercept-url pattern="/user/{id}/edit" access="#id == principal.userId"/>

http use-expressions it set to true and when a try principal.userId == 1 it works but i need to use the extracted value from the url.

i already tried all possible combinations.

Answer 1

It's not possible. But there is another way. You can define you own web expression that will be responsible for extracting of id parameter from URL. It may looks like that:

<security:intercept-url pattern="/user/{id}/edit" access="getIdUrlPathParameter() == principal.userId"/>

To do so you need:
1. Add CustomWebSecurityExpressionRoot that extends WebSecurityExpressionRoot
2. Add getIdUrlPathParameter() method. It will have access to HttpServletRequest object.
3. Define CustomWebSecurityExpressionHandler that extends DefaultWebSecurityExpressionHandler . Override createSecurityExpressionRoot method abd use your CustomWebSecurityExpressionRoot here.
4. Define custom access decision manager (xml below)
5. Inject it into your http element via access-decision-manager-ref attribute

<security:http access-decision-manager-ref="customAccessDecisionManagerBean" >
    <security:intercept-url pattern="/user/{id}/edit" access="getIdUrlPathParameter() == principal.userId"/>
</security:http>
<bean id="customWebSecurityExpressionHandler" class="com.domain.security.CustomWebSecurityExpressionHandler"/>
<bean id="customAccessDecisionManagerBean" class="org.springframework.security.access.vote.AffirmativeBased">
    <property name="decisionVoters">
        <list>
            <bean class="org.springframework.security.web.access.expression.WebExpressionVoter">
                <property name="expressionHandler" ref="customWebSecurityExpressionHandler" />
            </bean>
        </list>
    </property>
</bean>

Answer 2

Spring Security 无法做到这一点 。