禁止使用Spring Security和@Secured

Question

我已按如下方式设置Spring Security:

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private MongoUserDetailsService userServiceDetails;

@Autowired
private BCryptPasswordEncoder bCryptEncoder;

@Override
public void configure(WebSecurity web) throws Exception {
    web.ignoring().antMatchers("/js/**", "/css/**", "/fonts/**");
}

@Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .csrf().disable()
            .formLogin()
                .defaultSuccessUrl("/index", true)
                .loginPage("/login")
                .permitAll()
                .and()
            .httpBasic()
            .and()
            .logout()
                .permitAll()
                .deleteCookies("JSESSIONID")
                .invalidateHttpSession(true);
}

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth
       .userDetailsService(userServiceDetails)
       .passwordEncoder(bCryptEncoder);
}

在我的控制器上,我有以下内容:

@RequestMapping(method = RequestMethod.GET)
@Secured({"ADMIN"})
public List<Item> getItems(@RequestBody filter filter) {

    if (filter.hasMissingField()) {
        return new ArrayList<>();
    }

    return service.getItems(filter);
}

登录时,用户详细信息对象具有所需的角色(在调试中):

但是,我得到了403 - 禁止.我不明白为什么.如果我删除了@Secured,那么我可以正常访问该页面,但是使用@Secured({"ADMIN"})它会失败.

我已经梳理了SO而且我看到与@Secured有关的错误根本不起作用,与@Secured相关的错误在控制器级别没有任何影响但不像我当前的场景,它无法使用所需的角色进行授权.

如果它有助于我使用Spring Boot 1.3.2.

任何帮助将不胜感激.谢谢

Answer 1

你必须@Secured({"ROLE_ADMIN"})加上ROLE_前缀