URL和方法的Spring Security设置

Question

@Override
protected void configure(HttpSecurity http) throws Exception { 


  RequestHeaderAuthenticationFilter siteMinderFilter = new RequestHeaderAuthenticationFilter();
  siteMinderFilter.setPrincipalRequestHeader("SM_USER");
  siteMinderFilter.setAuthenticationManager(authenticationManager());

  http.addFilter(siteMinderFilter);  


  List<HttpMethod> methods = new ArrayList<HttpMethod>();
  methods.add(HttpMethod.GET);
  methods.add(HttpMethod.POST);
  methods.add(HttpMethod.PUT);
  methods.add(HttpMethod.DELETE);

 List<String> resources = new ArrayList<String>();
 resources.add("A");
 resources.add("B");
 resources.add("C");     
 ExpressionUrlAuthorizationConfigurer<HttpSecurity>.ExpressionInterceptUrlRegistry registry = http.authorizeRequests();

 for (HttpMethod method:methods){
     for (String resource: resources){
         String auth = "resource-"+resource+"-"+method.name();
         registry.antMatchers(method, "**/"+resource+"/**")
         .hasAuthority(auth);
     }
 }

  http = registry.and();
  http.formLogin();   

}

Answer 1

过滤器不起作用的唯一原因是匹配器模式开始时缺少斜杠/:

代替这个

 registry.antMatchers(method, "**/"+resource+"/**") 

我应该写这个的

 registry.antMatchers(method, "/**/"+resource+"/**")