Spring Security@Security拒绝访问，即使授予了正确的权限

Question

配置：

@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)

我正在使用JWT，所以我有一个过滤器来创建基于它的用户：

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
        throws ServletException, IOException {
    try {
        String jwt = parseJwt(request);
        if (jwt != null && jwtUtils.validateJwtToken(jwt)) {
            String username = jwtUtils.getUserNameFromJwtToken(jwt);

            UserDetails userDetails = userDetailsService.loadUserByUsername(username);

            UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(
                    userDetails, null, userDetails.getAuthorities());
            authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));

            SecurityContextHolder.getContext().setAuthentication(authentication);
        }
    } catch (Exception e) {
        logger.error("Cannot set user authentication: {}", e);
    }

    filterChain.doFilter(request, response);
}

我的userDetailsService填充GrantedAuthorities：

User user = userRepository.findByUsername(username)
            .orElseThrow(() -> new UsernameNotFoundException("User Not Found with username: " + username));

    Collection<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
    authorities.add(new SimpleGrantedAuthority(user.getStatus().name()));
    
    return UserDetailsImpl.builder().username(user.getUsername()).guid(user.getGuid()).name(user.getName())
            .password(user.getPassword()).status(user.getStatus()).authorities(authorities).build();

@PutMapping("/auth/activate")
@Secured("ROLE_VALIDATING")
public ResponseEntity<?> activateAccount(Authentication authentication) {
    accountService.activateAccount(authentication.getName());
    return ResponseEntity.ok().body(new MessageResponse("Account Activated"));
}

Authentication auth = SecurityContextHolder.getContext().getAuthentication();
if (auth != null && auth.getAuthorities().stream().anyMatch(a -> a.getAuthority().equals("VALIDATING"))) {
    LOG.info("I has the role!");
}

Answer 1

参见Ken S.的评论。

您正在测试的GrantedAuthority“validating”只是一个权威，但是您正在测试注释中的“role_validating”。我不确定@Security是否接受授权，我发现的所有示例都是角色。如果要使用角色，您可能希望测试@preauthorize（“hasauthority('validating')”），或者将该权限重命名为“role_validating”。-肯24分钟前

对于后面的人，我所做的更改是切换到hasAuthority和@PreAuthorize注释。或者我更改了我的UserDetailsService：

Collection<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
    authorities.add(new SimpleGrantedAuthority(String.format("ROLE_%s", user.getStatus())));