Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-05-22 21:33:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '7.0.x'

Browse Source
This commit is contained in:
Josh Cummings
2026-03-27 16:40:04 -06:00
parent 2c32a9a969 6020ab8e65
commit c489136515
1 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/modules/ROOT/pages/servlet/authorization/method-security.adoc
+17 -9
View File
@@ -1382,12 +1382,15 @@ Java::
[source,java,role="primary"] [source,java,role="primary"]
---- ----
@Component @Component
public class MyAuthorizationManager implements AuthorizationManager<MethodInvocation>, AuthorizationManager<MethodInvocationResult> { public class MyPreAuthorizeAuthorizationManager implements AuthorizationManager<MethodInvocation> {
@Override @Override
public AuthorizationResult authorize(Supplier<Authentication> authentication, MethodInvocation invocation) { public AuthorizationResult authorize(Supplier<Authentication> authentication, MethodInvocation invocation) {
// ... authorization logic // ... authorization logic
} }
}
@Component
public class MyPostAuthorizeAuthorizationManager implements AuthorizationManager<MethodInvocationResult> {
@Override @Override
public AuthorizationResult authorize(Supplier<Authentication> authentication, MethodInvocationResult invocation) { public AuthorizationResult authorize(Supplier<Authentication> authentication, MethodInvocationResult invocation) {
// ... authorization logic // ... authorization logic
@@ -1400,11 +1403,14 @@ Kotlin::
[source,kotlin,role="secondary"] [source,kotlin,role="secondary"]
---- ----
@Component @Component
class MyAuthorizationManager : AuthorizationManager<MethodInvocation>, AuthorizationManager<MethodInvocationResult> { class MyPreAuthorizeAuthorizationManager : AuthorizationManager<MethodInvocation> {
override fun authorize(authentication: Supplier<Authentication>, invocation: MethodInvocation): AuthorizationResult { override fun authorize(authentication: Supplier<Authentication>, invocation: MethodInvocation): AuthorizationResult {
// ... authorization logic // ... authorization logic
} }
}
@Component
class MyPostAuthorizeAuthorizationManager : AuthorizationManager<MethodInvocationResult> {
override fun authorize(authentication: Supplier<Authentication>, invocation: MethodInvocationResult): AuthorizationResult { override fun authorize(authentication: Supplier<Authentication>, invocation: MethodInvocationResult): AuthorizationResult {
// ... authorization logic // ... authorization logic
} }
@@ -1427,13 +1433,13 @@ Java::
class MethodSecurityConfig { class MethodSecurityConfig {
@Bean @Bean
@Role(BeanDefinition.ROLE_INFRASTRUCTURE) @Role(BeanDefinition.ROLE_INFRASTRUCTURE)
Advisor preAuthorize(MyAuthorizationManager manager) { Advisor preAuthorize(MyPreAuthorizeAuthorizationManager manager) {
return AuthorizationManagerBeforeMethodInterceptor.preAuthorize(manager); return AuthorizationManagerBeforeMethodInterceptor.preAuthorize(manager);
} }
@Bean @Bean
@Role(BeanDefinition.ROLE_INFRASTRUCTURE) @Role(BeanDefinition.ROLE_INFRASTRUCTURE)
Advisor postAuthorize(MyAuthorizationManager manager) { Advisor postAuthorize(MyPostAuthorizeAuthorizationManager manager) {
return AuthorizationManagerAfterMethodInterceptor.postAuthorize(manager); return AuthorizationManagerAfterMethodInterceptor.postAuthorize(manager);
} }
} }
@@ -1446,15 +1452,15 @@ Kotlin::
@Configuration @Configuration
@EnableMethodSecurity(prePostEnabled = false) @EnableMethodSecurity(prePostEnabled = false)
class MethodSecurityConfig { class MethodSecurityConfig {
@Bean @Bean
@Role(BeanDefinition.ROLE_INFRASTRUCTURE) @Role(BeanDefinition.ROLE_INFRASTRUCTURE)
fun preAuthorize(manager: MyAuthorizationManager) : Advisor { fun preAuthorize(manager: MyPreAuthorizeAuthorizationManager): Advisor {
return AuthorizationManagerBeforeMethodInterceptor.preAuthorize(manager) return AuthorizationManagerBeforeMethodInterceptor.preAuthorize(manager)
} }
@Bean @Bean
@Role(BeanDefinition.ROLE_INFRASTRUCTURE) @Role(BeanDefinition.ROLE_INFRASTRUCTURE)
fun postAuthorize(manager: MyAuthorizationManager) : Advisor { fun postAuthorize(manager: MyPostAuthorizeAuthorizationManager): Advisor {
return AuthorizationManagerAfterMethodInterceptor.postAuthorize(manager) return AuthorizationManagerAfterMethodInterceptor.postAuthorize(manager)
} }
} }
@@ -1471,13 +1477,13 @@ Xml::
<bean id="preAuthorize" <bean id="preAuthorize"
class="org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor" class="org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor"
factory-method="preAuthorize"> factory-method="preAuthorize">
<constructor-arg ref="myAuthorizationManager"/> <constructor-arg ref="myPreAuthorizeAuthorizationManager"/>
</bean> </bean>
<bean id="postAuthorize" <bean id="postAuthorize"
class="org.springframework.security.authorization.method.AuthorizationManagerAfterMethodInterceptor" class="org.springframework.security.authorization.method.AuthorizationManagerAfterMethodInterceptor"
factory-method="postAuthorize"> factory-method="postAuthorize">
<constructor-arg ref="myAuthorizationManager"/> <constructor-arg ref="myPostAuthorizeAuthorizationManager"/>
</bean> </bean>
---- ----
====== ======
@@ -1487,6 +1493,8 @@ Xml::
You can place your interceptor in between Spring Security method interceptors using the order constants specified in `AuthorizationInterceptorsOrder`. You can place your interceptor in between Spring Security method interceptors using the order constants specified in `AuthorizationInterceptorsOrder`.
==== ====
You can also implement `MethodAuthorizationDeniedHandler` in the same manager class to override the default exception-handling behavior.
[[customizing-expression-handling]] [[customizing-expression-handling]]
=== Customizing Expression Handling === Customizing Expression Handling