Permission checking for Spring Security

There are two configuration methods for Spring Security permission check. One is the traditional XML configuration/JAVA code configuration (HttpSecurity object), and the other is to use Annotation at the Controller layer.

In terms of source code, use HttpSecurity or configure http xml tag. Permission verification is processed in the last Filter -- FilterSecurityInterceptor of the Filter Chain. Logically, it will first search for the permissions configured by this URL in the configuration (XML/Java Config) in the reverse direction according to the URL accessed. Then, according to the configured voter, take the Authentication object in the current access, and match the configured permissions (usually EL expressions such as hasRole... etc.), if the match is unsuccessful, an AccessDeniedException exception will be thrown, by Upper Filter:ExceptionTranslationFilter processing.

The permissions configured by Annotation are executed after that. The principle is to use Spring AOP. Before the Controller method is called, it will enter the MethodSecurityInterceptor class, and implement the verification logic in its parent abstract class. The methods are all using the voting device, so I will not repeat them.