@安全注释在AspectJ模式下无法使用Autoproxy

Question

我试图让我的Spring MVC应用程序更好地使用Spring@Securited注释和AspectJ自动代理，但它似乎没有代理或识别我的@Securited注释。我有一个这样的控制器：

@Controller
@RequestMapping("/")
public class ApplicationController {

    private ApplicationFactory applicationFactory;

    @Inject
    public ApplicationController(ApplicationFactory applicationFactory) {
        super();
        this.applicationFactory = applicationFactory;
    }

    @Secured("ROLE_USER")
    @ResponseBody
    @RequestMapping(method = GET)
    public Application getApplicationInfo() {
        return applicationFactory.buildApplication(this);
    }

}

和一个看起来如下所示的spring security XML：

代码：

  <security:global-method-security secured-annotations="enabled" mode="aspectj" proxy-target-class="true" />

  <security:http auto-config="true" use-expressions="true">
    <security:http-basic/>
  </security:http>

@Configuration
@ComponentScan(basePackages = {"com.example"})
@EnableWebMvc
@ImportResource("classpath:security.xml")
public class ApplicationConfiguration extends WebMvcConfigurerAdapter {

}

public class SpringMvcInitializer implements WebApplicationInitializer {

    private final AnnotationConfigWebApplicationContext context = new AnnotationConfigWebApplicationContext();

    public void onStartup(ServletContext servletContext) throws ServletException {
        context.register(ApplicationConfiguration.class);

        servletContext.addListener(new ContextLoaderListener(context));
        servletContext.addListener(new Log4jConfigListener());

        final DelegatingFilterProxy proxy = new DelegatingFilterProxy("springSecurityFilterChain", context);
        FilterRegistration.Dynamic filter = servletContext.addFilter("securityFilter", proxy);
        filter.addMappingForUrlPatterns(EnumSet.of(REQUEST), false, "/*");

        final DispatcherServlet servlet = new DispatcherServlet(context);
        ServletRegistration.Dynamic dispatcher = servletContext.addServlet("dispatcher", servlet);
        dispatcher.setLoadOnStartup(1);
        dispatcher.addMapping("/*");
    }

}

我是不是漏掉了什么？我尝试将@EnableAspectJAutoProxy(proxyTargetClass=true)添加到应用程序配置中，但这也没有帮助。是要运行时编织还是必须使用编译时编织来为应用程序启用基于注释的安全性？

Answer 1

在Spring中使用AOP时，您可以在AOP的两种实现中进行选择：

>

Spring AOP实现不需要编织，但它只适用于Spring管理的bean并且有一些限制

AspectJ AOP实现可以对所有对象工作，没有Spring AOP的限制，但需要编译时或加载时编织