Question

<http > <intercept-url pattern="/a.jsp" access="hasRole( ROLE_X )"/> </http>
in spring security3.0.7 or 3.1
it is Ok. only ROLE_X can see a.jsp page.

but:
<global-method-security > <protect-pointcut expression="execution(* test.Test.o1*(..))" access="hasRole( ROLE_X )"/> </global-method-security>
it is not working,eneryone can use the method test.Test.o1~~

when pre-post-annotations="enabled"
@PreAuthorize("hasRole( ROLE_X )")
it is also not working,eneryone can use the method test.Test.o1~~

i m so sad~~
any advise or used global-method-security demo , ths.

Answer 1

你们需要把这一诺言放在“灯塔”。

http://static.springsource.org/spring-security/site/faq/faq.html#faq-method-security-in-web-context

See also: Can Spring Security use @PreAuthorize on Spring controllers methods?

友情链接