spring security 自定义动态权限

package com.fashion.config; import com.fashion.security.UrlAntPatchMetadataSource; import com.fashion.security.UserServiceDetailImpl; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.ApplicationContext; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.ObjectPostProcessor; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.config.annotation.web.configurers.UrlAuthorizationConfigurer; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.web.access.intercept.FilterSecurityInterceptor; /** * Created with IntelliJ IDEA. * User: LQ * Date: 2024/09/10 11:49 * Description: spring security 配置 */ @Configuration @EnableGlobalMethodSecurity(prePostEnabled = true) public class SecurityConfiguration extends WebSecurityConfigurerAdapter { @Autowired private UserDetailsService userDetailsService; @Autowired private UrlAntPatchMetadataSource urlAntPatchMetadataSource; @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(userDetailsService); } @Override protected void configure(HttpSecurity http) throws Exception { // 1、获取工厂对象 ApplicationContext applicationContext = http.getSharedObject(ApplicationContext.class); // 2、设置自定义url 匹配规则 http.apply(new UrlAuthorizationConfigurer<>(applicationContext)) .withObjectPostProcessor(new ObjectPostProcessor<FilterSecurityInterceptor>() { @Override public <O extends FilterSecurityInterceptor> O postProcess(O object) { object.setSecurityMetadataSource(urlAntPatchMetadataSource); // 如果没有权限是否拒绝 object.setRejectPublicInvocations(true); return object; } }); http.authorizeRequests() .anyRequest().authenticated() .and().formLogin()//开启表单登录 .and().csrf().disable(); } }