在我的spring boot应用程序中,我有一个spring mvc方法,它由spring安全性保护。我将id作为路径变量传递给此方法,spring数据参数解析器查找并绑定实体,但当id无效时,实体为空;当实体为空时,我想抛出404;因为spring安全PreAuthorize需要一个非空实体来检查用户授权;我的代码是:
@PutMapping(value = "/{address}")
@PreAuthorize("isAuthenticated() and (#address.user.id == #user.id)")
public ResponseEntity<ResponseModel> update(@Valid @RequestBody AddressModel addressModel, @PathVariable Address address, @AuthenticationPrincipal User user) {
try {
addressService.update(user, address, addressModel);
} catch (Exception e) {
return new ResponseEntity<>(new ResponseModel(e.getMessage(), ResponseModel.ResponseStatus.ERROR), HttpStatus.BAD_REQUEST);
}
return new ResponseEntity<>(new ResponseModel(messages.get("def.op.success"), ResponseModel.ResponseStatus.SUCCESS), HttpStatus.OK);
}
我还测试了
@PreAuthorize("isAuthenticated() and (#address != null and #address.user.id == #user.id)")
但是它返回一个403错误;
发布于 2019-01-30 12:29:45
您不能简单地将注释移动到您的服务中吗?
@PutMapping(value = "/{address}")
//@PreAuthorize("isAuthenticated() and
//(#address.user.id == #user.id)") <-- move to service method
public ResponseEntity<ResponseModel> update(
@Valid @RequestBody AddressModel addressModel, @PathVariable Address address,
@AuthenticationPrincipal User user) {
if(address == null){
//throw some exception that gets translated to 404
}
try {
//check will be applied on call to service
addressService.update(user, address, addressModel);
} catch (Exception e) {
return new ResponseEntity<>(new ResponseModel(e.getMessage(),
ResponseModel.ResponseStatus.ERROR), HttpStatus.BAD_REQUEST);
}
return new ResponseEntity<>(new ResponseModel(messages.get("def.op.success"),
ResponseModel.ResponseStatus.SUCCESS), HttpStatus.OK);
}
https://stackoverflow.com/questions/54437542
复制相似问题