在Spring Boot中，实现对特定URL的权限验证可以通过以下几种方式：
- 使用Spring MVC的HandlerInterceptor接口（拦截器）。
- 使用Spring AOP和AspectJ（切面）。
- 使用Spring Security（安全框架）。
下面是使用这三种方式的简单示例：
- 使用Spring MVC的HandlerInterceptor：
@Component
public class AuthInterceptor implements HandlerInterceptor {
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
// 验证逻辑
String token = request.getHeader("Authorization");
if (token == null || !token.startsWith("Bearer ")) {
response.setStatus(HttpStatus.UNAUTHORIZED.value());
return false;
}
return true;
}
}
@Configuration
public class WebConfig implements WebMvcConfigurer {
@Autowired
private AuthInterceptor authInterceptor;
@Override
public void addInterceptors(InterceptorRegistry registry) {
registry.addInterceptor(authInterceptor)
.addPathPatterns("/api/protected/**"); // 需要验证权限的URL
}
}- 使用Spring AOP和AspectJ：
@Aspect
@Component
public class AuthAspect {
@Before("execution(* com.example.controller.ApiController.*(..))")
public void validateToken(JoinPoint joinPoint) {
// 获取HttpServletRequest对象
ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
HttpServletRequest request = attributes.getRequest();
// 验证逻辑
String token = request.getHeader("Authorization");
if (token == null || !token.startsWith("Bearer ")) {
throw new RuntimeException("Invalid token");
}
}
}- 使用Spring Security：
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.authorizeRequests()
.antMatchers("/api/protected/**").authenticated()
.anyRequest().permitAll()
.and()
.addFilter(new AuthenticationFilter(authenticationManager()));
}
}
public class AuthenticationFilter extends UsernamePasswordAuthenticationFilter {
public AuthenticationFilter(AuthenticationManager authenticationManager) {
super(authenticationManager);
}
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) {