SpringBoot Security set permission test results
ADMIN2,ROLE_ADMIN
String[] permissions = "ADMIN2,ROLE_ADMIN".split(",");
List<GrantedAuthority> authorities = new ArrayList<>();
for (String permission : permissions) {
authorities.add(new SimpleGrantedAuthority(permission));
}
userDetails.setAuthorities(authorities);
Add the method annotation permission test result on the controller:
@PreAuthorize("hasRole('ADMIN')") //允许
@PreAuthorize("hasRole('ROLE_ADMIN')") //允许
@PreAuthorize("hasRole('ADMIN2')") //不允许
@PreAuthorize("hasRole('ROLE_ADMIN2')") //不允许
@PreAuthorize("hasAuthority('ADMIN2')") //允许
@PreAuthorize("hasAuthority('ROLE_ADMIN2')") //不允许
@PreAuthorize("hasAuthority('ADMIN')") //不允许
@PreAuthorize("hasAuthority('ROLE_ADMIN')") //允许
The test shows:
Add the prefix ROLE_ to verify permissions in three ways:
@PreAuthorize("hasRole('ADMIN')") //允许
@PreAuthorize("hasRole('ROLE_ADMIN')") //允许
@PreAuthorize("hasAuthority('ROLE_ADMIN')") //允许
There is only one way to verify permissions without increasing ROLE_:
@PreAuthorize("hasAuthority('ADMIN2')") //允许