基于注释的安全性限制不适用于Web套接字触发的方法调用

Question

我对此做了一些研究,但我找不到解决方案.

我有这样的课

@Stateless
class ConfigBean {
  @RequiresRole("administrator")
  public void reloadConfiguration(){
     ......
  }
}

我有一个JAX-RS(平针织)服务如下.

@Path("config")
class ConfigService{

  @EJB
  ConfigBean config;

  @Get
  @Path("reload")
  public void reload(){ 
     config.reloadConfiguration();
  }
}

这将在调用API时正常工作/Test/config/relaod(即仅与管理员用户一起工作).

但是下面的代码没有按预期工作(即普通用户可以触发重载配置方法),

@ServerEndpoint("/socket") 
public class EchoServer {
/**
 * @OnOpen allows us to intercept the creation of a new session.
 * The session class allows us to send data to the user.
 * In the method onOpen, we'll let the user know that the handshake was 
 * successful.
 */

@EJB
ConfigBean config;

@OnOpen
public void onOpen(Session session){
    System.out.println(session.getId() + " has opened a connection"); 
    try {
        session.getBasicRemote().sendText("Connection Established");
    } catch (IOException ex) {
        ex.printStackTrace();
    }
}

/**
 * When a user sends a message to the server, this method will intercept the message
 * and allow us to react to it. For now the message is read as a String.
 */
@OnMessage
public void onMessage(String message, Session session){
    System.out.println("Message from " + session.getId() + ": " + message);
    try {
        if(message.equalsIgnoreCase("reloadConfig")){
           config.reloadConfiguration();
        }
    } catch (IOException ex) {
        ex.printStackTrace();
    }
 }

/**
 * The user closes the connection.
 * 
 * Note: you can't send messages to the client from this method
 */
@OnClose
public void onClose(Session session){
    System.out.println("Session " +session.getId()+" has ended");
   }
}

Answer 1

Shiro JAX-RS 集成仅拦截 JAX-RS 端点。

对于更通用的注释方法，您可以使用 Guice、Spring 或 AspectJ 集成。

如果您正在使用 CDI，您可以查看Shiro Annotation Interceptor 的这个分支，这只是第一遍，但它正在工作