spring boot REST security URL and METHOD annotation
先通过http request 级别的过滤
即所有的访问都必须满足拥有 USER权限
@Override
protected void configure(HttpSecurity http) throws Exception {
// @formatter:off
http
.csrf().disable();
http
.authorizeRequests()
.antMatchers("/**").hasRole("USER")
.and()
.httpBasic()
;
// @formatter:on
}再通过方法级别的验证
也就是说想要访问/adminAT的用户所拥有的roles必须包含USER
像这样.withUser("provider").password("providerTenmax").roles("PROVIDER", "USER")
这样才能成功使用provider用户访问/adminAT接口
@RolesAllowed({"ADMIN","PROVIDER"})
@RequestMapping(value = "/adminAT", method = RequestMethod.GET)
public @ResponseBody String adminAT() {
System.out.println("user adminAT login !");
return "user adminAT login";
}