bap.pp.strongbox.security.service

Class WebSecurityPermissionEvaluator

java.lang.Object

bap.core.service.BaseService

bap.pp.strongbox.security.service.WebSecurityPermissionEvaluator

@Service(value="webSecurityPermissionEvaluator")
public class WebSecurityPermissionEvaluator
extends bap.core.service.BaseService

spring security基于会话访问级别的过滤方法

Author:

Amanda.Z

Field Summary

Fields

Modifier and Type	Field and Description
static java.lang.String[]	antMatchNoFilterUrl
static java.lang.String[]	deleteNoFilterUrl
static java.lang.String[]	getNoFilterUrl
static java.lang.String[]	postNoFilterUrl
static java.lang.String[]	putNoFilterUrl

Constructor Summary

Constructors

Constructor and Description
WebSecurityPermissionEvaluator()

Method Summary

Modifier and Type	Method and Description
void	createNoFilterConfig()
java.lang.String[]	noFilterFile() 获取不需要过滤的文件类型
boolean	noFilterMatch(org.springframework.security.core.Authentication authentication, javax.servlet.http.HttpServletRequest request) 不需要过滤的请求和文件，此处实现永真返回true,只是为了记录访问日志，spring security的配置规则是按配置顺序优先，不过滤的必须先配，这样这些文件和路径就不会皱上面的过滤方法，尽管在config类设置了统配
boolean	protectResource(org.springframework.security.core.Authentication authentication, javax.servlet.http.HttpServletRequest request) 菜单与资源越权访问过滤

Methods inherited from class bap.core.service.BaseService

getBaseDao, setBaseDao

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

postNoFilterUrl

public static java.lang.String[] postNoFilterUrl

getNoFilterUrl

public static java.lang.String[] getNoFilterUrl

putNoFilterUrl

public static java.lang.String[] putNoFilterUrl

deleteNoFilterUrl

public static java.lang.String[] deleteNoFilterUrl

antMatchNoFilterUrl

public static java.lang.String[] antMatchNoFilterUrl

Constructor Detail

WebSecurityPermissionEvaluator

public WebSecurityPermissionEvaluator()

Method Detail

createNoFilterConfig

public void createNoFilterConfig()

protectResource

public boolean protectResource(org.springframework.security.core.Authentication authentication,
                               javax.servlet.http.HttpServletRequest request)

菜单与资源越权访问过滤

Parameters:

authentication - 系统认证对象，其中包含登录用户信息

request - 当前请求

Returns:

noFilterMatch

public boolean noFilterMatch(org.springframework.security.core.Authentication authentication,
                             javax.servlet.http.HttpServletRequest request)

不需要过滤的请求和文件，此处实现永真返回true,只是为了记录访问日志，spring security的配置规则是按配置顺序优先，不过滤的必须先配，这样这些文件和路径就不会皱上面的过滤方法，尽管在config类设置了统配

Parameters:

authentication -

request -

Returns:

noFilterFile

public java.lang.String[] noFilterFile()

获取不需要过滤的文件类型

Returns: