Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-05 17:57:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add MessageExpressionAuthorizationManager

Browse Source 
Closes gh-12650

Signed-off-by: wonderfulrosemari <whwlsgur1419@naver.com>
This commit is contained in:
wonderfulrosemari
2026-03-04 10:05:54 +09:00
committed by Josh Cummings
parent b1f4deafe6
commit 07297e7a80
4 changed files with 262 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/modules/ROOT/pages/servlet/integrations/websocket.adoc
+7 -27
View File
@@ -212,32 +212,10 @@ This will ensure that:
If you are migrating from an older version of Spring Security, your destination matchers may include SpEL expressions.
It's recommended that these be changed to using concrete implementations of `AuthorizationManager` since this is independently testable.
However, to ease migration, you can also use a class like the following:
However, to ease migration, you can use
`org.springframework.security.messaging.access.expression.MessageExpressionAuthorizationManager`.
[source,java]
----
public final class MessageExpressionAuthorizationManager implements AuthorizationManager<MessageAuthorizationContext<?>> {
private SecurityExpressionHandler<Message<?>> expressionHandler = new DefaultMessageSecurityExpressionHandler();
private Expression expression;
public MessageExpressionAuthorizationManager(String expressionString) {
Assert.hasText(expressionString, "expressionString cannot be empty");
this.expression = this.expressionHandler.getExpressionParser().parseExpression(expressionString);
}
@Override
public AuthorizationResult authorize(Supplier<Authentication> authentication, MessageAuthorizationContext<?> context) {
EvaluationContext ctx = this.expressionHandler.createEvaluationContext(authentication, context.getMessage());
boolean granted = ExpressionUtils.evaluateAsBoolean(this.expression, ctx);
return new ExpressionAuthorizationDecision(granted, this.expression);
}
}
----
And specify an instance for each matcher that you cannot get migrate:
And specify an instance for each matcher that you cannot yet migrate:
[tabs]
======
@@ -252,7 +230,8 @@ public class WebSocketSecurityConfig {
public AuthorizationManager<Message<?>> messageAuthorizationManager(MessageMatcherDelegatingAuthorizationManager.Builder messages) {
messages
// ...
.simpSubscribeDestMatchers("/topic/friends/{friend}").access(new MessageExpressionAuthorizationManager("#friends == 'john"));
.simpSubscribeDestMatchers("/topic/friends/{friend}")
.access(new MessageExpressionAuthorizationManager("#friend == 'john'"));
// ...
return messages.build();
@@ -269,7 +248,8 @@ open class WebSocketSecurityConfig {
fun messageAuthorizationManager(messages: MessageMatcherDelegatingAuthorizationManager.Builder): AuthorizationManager<Message<?> {
messages
// ..
.simpSubscribeDestMatchers("/topic/friends/{friends}").access(MessageExpressionAuthorizationManager("#friends == 'john"))
.simpSubscribeDestMatchers("/topic/friends/{friend}")
.access(MessageExpressionAuthorizationManager("#friend == 'john'"))
// ...
return messages.build()