1. Add dependencies (aspectjweaver dependencies)
<dependency> <groupId>org.aspectj</groupId> <artifactId>aspectjweaver</artifactId> <version>1.8.13</version> </dependency>
2. In SpringMvc.Xml
Configure to open the proxy, inject LifecycleBeanPostProcessor, AuthorizationAttributeSourceAdvisor
<aop:config proxy-target-class="true"/> <bean class ="org.apache.shiro.spring.LifecycleBeanPostProcessor"></bean> <bean class ="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"></bean>
3. Available in Controller
@RequiresRoles("admin") //Authentication roles
@RequiresPermissions("user:delect1") //Verify permissions
Remarks to expand:
① Choose spring's AOP or AspectJ? Spring does have its own AOP. The function is basically enough, unless you want to dynamically proxy or method interception on the interface to the getter and setter. These are all requirements for writing strange things and are generally not used.
②When using AOP, do you use xml or annotation (@Aspect)?
1) If the xml method is used, no additional jar package is required.
2) If you use the @Aspect method, you can do it directly with an @Aspect on the class, without having to configure it in xml. But this requires an additional jar (aspectjweaver.jar). Because spring uses AspectJ's annotation function directly, note that it only uses its annotation function. Not a core function! ! !
Note that there is another very interesting sentence in the documentation: The documentation says whether to choose spring AOP or use full aspectJ? What is full aspectJ? If you use "full aspectJ". That is to say, you can implement interface-based dynamic proxy, and other powerful functions. And not just note-solution-feature-function of aspectj! ! ! If using full AspectJ. For example, the Load-Time Weaving method also requires an additional jar package spring-instrument.jar. Of course, whether you use spring aop or aspectj, both aspectjweaver.jar and spring-aop.jar are required.