如何解决PreAuthorize在Spring Security中不起作用？

为什么@PreAuthorize不起作用？它不会引发任何异常或错误。我已经为这项任务苦苦挣扎了好几天。我已经尝试了很多选项，但是没有用。

我将非常感谢任何能帮助解决此问题的人problem。

SecurityConfig.java

    package com.testpreauthorize.security;

    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.ComponentScan;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
    import org.springframework.security.core.userdetails.UserDetailsService;

    @Configuration
    @EnableWebSecurity
    @EnableGlobalMethodSecurity(prePostEnabled = true)
    public class SecurityConfig extends WebSecurityConfigurerAdapter {

        @Autowired
        UserDetailsService userDetailsService;

        @Autowired
        protected void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth.userDetailsService(userDetailsService);
        }





        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                    .authorizeRequests()
                    .anyRequest()
                    .permitAll()


                    .and()
                    .formLogin()
                    .loginPage("/login")
                    .loginProcessingUrl("/login")

                    .defaultSuccessUrl("/")

                    .and()

                    .logout()
                    .permitAll()
                    .logoutUrl("/logout")
                    .logoutSuccessUrl("/")

                    .invalidateHttpSession(true)
                    .deleteCookies("JSESSIONID")
                    .and()
                    .csrf().disable();

        }


    }

HomeController.java

    package com.testpreauthorize.controller;

    import org.springframework.security.access.prepost.PreAuthorize;
    import org.springframework.stereotype.Controller;
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.PostMapping;

    @Controller
    public class HomeController {

        @GetMapping(value = "/")
        public String home () {
            return "/home";
        }


        @PreAuthorize("isAuthenticated()")
        @GetMapping(value = "/user")
        public String user () {
            return "/user";

        }


        @GetMapping(value = "/login")
        public String loginGet () {
            return "/login";
        }

        @PostMapping(value = "/login")
        public String loginPost () {
            return "redirect:/user";
        }


    }

解决方法

暂无找到可以解决该程序问题的有效方法，小编努力寻找整理中！

如果你已经找到好的解决方法，欢迎将解决方案带上本链接一起发送给小编。

小编邮箱:dio#foxmail.com (将#修改为@）

    <security:intercept-url pattern="/user/{id}/edit" access="#id == principal.userId"/>

<security:intercept-url pattern="/user/{id}/edit" access="getIdUrlPathParameter() == principal.userId"/>

<security:http access-decision-manager-ref="customAccessDecisionManagerBean" >    <security:intercept-url pattern="/user/{id}/edit" access="getIdUrlPathParameter() == principal.userId"/></security:http><bean id="customWebSecurityExpressionHandler"/><bean id="customAccessDecisionManagerBean">    <property name="decisionVoters">        <list>            <bean>                <property name="expressionHandler" ref="customWebSecurityExpressionHandler" />            </bean>        </list>    </property></bean>