Spring security给出了403个正确的凭据

Question

@RestController
@RequestMapping (value = "/api/secured/resource/school")
@Secured ({ ApplicationConstants.Role.SYSTEM_ADMIN, ApplicationConstants.Role.SCHOOL_ADMIN })
public class SchoolController
{

    @Autowired
    private SchoolService schoolService;

    @PostMapping (consumes = "application/json")
    @Secured ({ ApplicationConstants.Role.SYSTEM_ADMIN })
    public @ResponseBody ResponsePayload createSchool (HttpServletRequest request, @RequestBody School school)
            throws ServiceException
{
}

 interface Role
    {

        String SYSTEM_ADMIN = "SYSTEM_ADMIN";

        String SCHOOL_ADMIN = "SCHOOL_ADMIN";
    }

Spring配置

<http pattern="/static/**" security="none" />
    <http use-expressions="true">
        <intercept-url pattern="/app/**" access="isAuthenticated()" /> 
        <form-login login-page="/loginPage"
            authentication-success-handler-ref="mySuccessHandler"
            authentication-failure-handler-ref="myFailureHandler" />
        <logout logout-success-url="/loginPage" />
        <custom-filter ref="loginFilter" after="FIRST" />
        <csrf disabled="true" />
    </http>

2016-07-15 16:03:12,525 DEBUG MethodSecurityInterceptor:348-以前通过身份验证:org.springframework.security.authentication.usernamePasswordAuthenticationToken@7670236f:principal:SystemUser[userid=1,name=Administrator，email=[e-mail],mobilePhone=9999999999,status=active]；全权证书:[受保护]；认证：真；详细信息：org.springframework.security.web.authentication.webauthenticationdetails@0:remoteIPaddress:0:0:0:0:0:0:0:0:0:0:0:1；Sessionid:1H5X6YXTD1M0Y1OGS4H5VFO1YL；授予权限:SYSTEM_USER,SYSTEM_ADMIN 2016-07-15 16:03:12,525 DEBUG肯定性基础:66-voter:org.springframework.security.Access.vote.rolevoter@55951fcd,返回：0 201 6-07-15 16:03:12,527 DEBUG肯定性基础:66-voter:org.springframework.security.Access.vote.authenticatedvoter@46ab4efc,返回：0 201 6-07-15 16:03:12,529 DEBUG createSchool（javax.servlet.http.HttpServletRequest,com.tepachi.db.entities.user.school）抛出com.tepachi.exception.ServiceException]:org.springframework.security.Access.AccessDeniedException：访问被拒绝

Answer 1

问题是Spring4以后，它将ROLE_准备到授予的权限。

hasRole([role]):如果当前主体具有指定的角色，则返回true。默认情况下，如果提供的角色不以'role_'开头，则将添加该角色。这可以通过修改DefaultWebSecurityExpressionHandler上的defaultRolePrefix来定制。

更多信息可以在这里找到Spring Doc