小编Noa*_*erg的帖子

我有一个配置了spring security的Web应用程序,用于限制对URL和方法的访问.我想在默认情况下完全禁用它,并允许我的客户在需要时轻松打开它们(他们只能访问"spring-security.xml").

我设法关闭URL拦截,但我的方法安全性仍然启用...

任何线索？

(我不想让客户更改我的web.xml,所以不幸的是每次修改"global-method-security"设置都不是一个选项......)

这是我更新的spring-security.xml配置:

<http auto-config='true' use-expressions="true">
    <intercept-url pattern="/**" access="permitAll" />
    <http-basic />
    <anonymous />
</http>

我已经覆盖了DelegatingFilterProxy.doFilter方法,如下所示:

public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
    final String springSecured = System.getProperty("springSecured");

    if (StringUtils.isNotBlank(springSecured) && springSecured.equalsIgnoreCase("true")) {
        // Call the delegate
        super.doFilter(request, response, filterChain);
    } else {
        // Ignore the DelegatingProxyFilter delegate
        filterChain.doFilter(request, response);
    }
}

这是我拥有的方法安全性的一个例子:

@RequestMapping(
        value = "applications/{applicationName}/timeout/{timeout}",
        method = RequestMethod.POST)
public
@ResponseBody
@PreAuthorize("isFullyAuthenticated() and hasPermission(#authGroups, 'deploy')")
Object deployApplication() {
    // ...
}