資源的訪問權限都是放在數據庫當中的，不可能是放在代碼中，不然得有多少個`antMatchers(...).hasAuthority(...)`。 ```java @Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { ... @Override protected void configure(HttpSecurity http) throws Exception { ... http.authorizeRequests() .antMatchers("/layui/**", "/to/login") .permitAll() //當用戶有admin權限時才能訪問/account/message .antMatchers("/account/message").hasAuthority("admin") ... } } ``` <br/> 下面實現訪問資源`/account/message`時去數據庫查詢該資源所需的權限，具備相應的權限才能訪問。步驟如下： **1. 根據訪問的URL去數據庫查詢該URL所需要的權限** ```java @Component public class CustomFilterInvocationSecurityMetadataSource implements FilterInvocationSecurityMetadataSource { @Autowired private SysPermissionService sysPermissionService; @Override public Collection<ConfigAttribute> getAttributes(Object o) throws IllegalArgumentException { //獲取請求地址 String url = ((FilterInvocation) o).getRequestUrl(); //去數據庫查詢訪問該url所需要的權限 List<SysPermission> permissions = sysPermissionService.findByUrl(url); if(CollectionUtils.isEmpty(permissions)) { //返回null則表示無需任何權限即可訪問，即使沒有登錄 return null; } String[] attrs = new String[permissions.size()]; for (int i = 0; i < permissions.size(); i++) { attrs[i] = permissions.get(i).getPermission(); } return SecurityConfig.createList(attrs); } @Override public Collection<ConfigAttribute> getAllConfigAttributes() { return null; } @Override public boolean supports(Class<?> aClass) { return true; } } ``` **2. 攔截當前請求** AbstractSecurityInterceptor 攔截當前請求并獲取相關權限組成權限列表，將權限列表交給接口 AccessDecisionManager 做下一步處理。 ```java @Component public class CustomAbstractSecurityInterceptor extends AbstractSecurityInterceptor implements Filter { @Autowired private FilterInvocationSecurityMetadataSource securityMetadataSource; @Autowired public void setMyAccessDecisionManager(CustomAccessDecisionManager accessDecisionManager) { super.setAccessDecisionManager(accessDecisionManager); } @Override public Class<?> getSecureObjectClass() { return FilterInvocation.class; } @Override public SecurityMetadataSource obtainSecurityMetadataSource() { return this.securityMetadataSource; } @Override public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException { FilterInvocation fi = new FilterInvocation(servletRequest, servletResponse, filterChain); invoke(fi); } public void invoke(FilterInvocation fi) throws IOException, ServletException { //攔截當前請求的url，并判斷是否具備相應的權限 InterceptorStatusToken token = super.beforeInvocation(fi); try { //執行下一個攔截器 fi.getChain().doFilter(fi.getRequest(), fi.getResponse()); } finally { super.afterInvocation(token, null); } } } ``` **3. 實現接口AccessDecisionManager來判斷對當前請求是否放行** 如果有訪問當前資源的權限則放行，否則拋出異常。 ```java @Component public class CustomAccessDecisionManager implements AccessDecisionManager { @Override public void decide(Authentication authentication, Object o, Collection<ConfigAttribute> collection) throws AccessDeniedException, InsufficientAuthenticationException { Iterator<ConfigAttribute> iterator = collection.iterator(); while (iterator.hasNext()) { ConfigAttribute ca = iterator.next(); //當前請求需要的權限 String needRole = ca.getAttribute(); //當前用戶所具有的權限 Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities(); for (GrantedAuthority authority : authorities) { if (authority.getAuthority().equals(needRole)) { return; } } } throw new AccessDeniedException("權限不足!"); } @Override public boolean supports(ConfigAttribute configAttribute) { return true; } @Override public boolean supports(Class<?> aClass) { return true; } } ``` **4. 將上面的組件注冊到環境中** ```java @Configuration @EnableWebSecurity public class WebSecurityConfig extends WebSecurityConfigurerAdapter { .... @Autowired private CustomAbstractSecurityInterceptor securityInterceptor; @Autowired private CustomAccessDecisionManager accessDecisionManager; @Autowired private CustomFilterInvocationSecurityMetadataSource securityMetadataSource; ... @Override protected void configure(HttpSecurity http) throws Exception { ... http.authorizeRequests() .withObjectPostProcessor(new ObjectPostProcessor<FilterSecurityInterceptor>() { @Override public <O extends FilterSecurityInterceptor> O postProcess(O o) { o.setAccessDecisionManager(accessDecisionManager); o.setSecurityMetadataSource(securityMetadataSource); return o; } }); http.addFilterBefore(securityInterceptor, FilterSecurityInterceptor.class); ... } ... } ``` **5. 測試結果** 當有權限時正常訪問，無權限時返回 Forbidden 提醒。 ```json { "timestamp":"2022-07-29T03:30:32.813+00:00", "status":403, "error":"Forbidden", "message":"Forbidden", "path":"/account/message" } ```