Spring Boot Security-Thymeleaf SEC：授权-URL不工作

Question

默认情况下，SEC：authorize-URL标记不适用于Spring boot security：

git clone https://github.com/spring-projects/spring-boot

添加依赖项

<dependency>
    <groupId>org.thymeleaf.extras</groupId>
    <artifactId>thymeleaf-extras-springsecurity3</artifactId>
    <version>2.1.1.RELEASE</version>
</dependency>

@RequestMapping("/")
public String home(Map<String, Object> model) {
model.put("message", "Hello World");
model.put("title", "Hello Home");
model.put("date", new Date());
return "home";
}

@RequestMapping("/admin/foo")
public String home2(Map<String, Object> model) {
    model.put("message", "Hello World");
    model.put("title", "Hello Home");
    model.put("date", new Date());
    return "home";
}

http.authorizeRequests().antMatchers("/login").permitAll()
    .antMatchers("/admin/**").hasRole("ADMIN")
...

<div sec:authorize="hasRole('ROLE_ADMIN')">
    has role admin
 </div>
 <div sec:authorize-url="/admin/foo">
    can see /admin
 </div>

我是不是漏掉了什么？这是预期的行为吗？我需要定义什么才能使authorize-url像使用XML配置安全性时那样工作？

此问题与SpringBootWebSecurityConfiguration中的基本身份验证及其自动配置有关：

在SampleMethodSecurityApplication中，通过替换以下命令更改ApplicationSecurity顺序：

@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)

@Order(SecurityProperties.BASIC_AUTH_ORDER + 1)

security.basic.enabled: false

我找到了以下解决办法。只需在SecurityConfig中手动注册安全拦截器：

@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)
protected static class ApplicationSecurity extends WebSecurityConfigurerAdapter {

    @Override
    public void configure(final WebSecurity web) throws Exception {
        final HttpSecurity http = getHttp();
        web.postBuildAction(new Runnable() {
            @Override
            public void run() {
                web.securityInterceptor(http.getSharedObject(FilterSecurityInterceptor.class));
            }
        });
    }

它允许您使用推荐的ACCESS_OVERRIDE_ORDER和http基本自动配置。我在这里张贴了更多的细节，任何解释为什么这是工作是赞赏的。

Answer 1

使用thymeleaf-extras-springsecurity4应该可以解决这个问题

<dependency>
    <groupId>org.thymeleaf.extras</groupId>
    <artifactId>thymeleaf-extras-springsecurity4</artifactId>
</dependency>