关于 spring security 的一个问题

[Buffer2Disk]

代码如下，启用了两个不同的 HttpSecurity，分别为管理员和普通用户的

按照官方的文档的说明，设置了 order 优先级后，如果路径在普通用户这里没匹配到，那么就会去管理员那边匹配。

实际情况是，

@Order(1) 设置到了用户这边，管理员的路径就不会被拦截(没有去请求 login/admin)；

@Order(1) 设置到了管理员那边，用户这边的路径就不会被拦截(没有去请求 login/user)

这是什么原因呢？

官方文档如下 https://docs.spring.io/spring-security/site/docs/4.2.13.BUILD-SNAPSHOT/reference/htmlsingle/#multiple-httpsecurity

@EnableWebSecurity
public class MultiHttpSecurityConfig {

    /**
     * 普通用户路径的拦截
     */
    @Configuration
    @Order(1)
    public static class UserWebSecurityConfig extends WebSecurityConfigurerAdapter {
        @Autowired
        CustomAuthenticationSuccessHandler successHandler;

        @Autowired
        CustomAuthenticationFailureHandler failureHandler;

        @Autowired
        private CustomAuthenticationProvider customAuthProvider;

        @Autowired
        private CustomUserDetailsService userDetailsService;

        @Value("${my.cookie.timeout}")
        private int cookieTimeOut;


        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf().disable();
            http.authorizeRequests()
                .antMatchers("/css/**", "/js/**", "/images/**, /fonts/**").permitAll()
                .antMatchers("/bbb/**","/aaaa/**").hasAnyRole("USER");
            http.formLogin()
                .successHandler(successHandler)
                .failureHandler(failureHandler)
                .loginPage("/login/user").permitAll();
            http.logout().permitAll();

            http.rememberMe().key("uniqueAndSecret").tokenValiditySeconds(cookieTimeOut);
        }

        @Override
        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
            auth.authenticationProvider(customAuthProvider);
            auth.userDetailsService(userDetailsService);
        }
    }


    /**
     * 管理员路径的拦截
     */
    @Configuration
    public static class AdminWebSecurityConfig extends WebSecurityConfigurerAdapter {
        @Autowired
        CustomAuthenticationSuccessHandler successHandler;

        @Autowired
        CustomAuthenticationFailureHandler failureHandler;

        @Value("${my.cookie.timeout}")
        private int cookieTimeOut;

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http.csrf().disable();
            http.authorizeRequests()
                .antMatchers("/css/**", "/js/**", "/images/**, /fonts/**").permitAll()
                .antMatchers("/ccc/**","/dddd").hasAnyRole("ADMIN");
            http.formLogin()
                .successHandler(successHandler)
                .failureHandler(failureHandler)
                .loginPage("/login/admin").permitAll();
            http.logout().permitAll();

            http.rememberMe().key("uniqueAndSecret").tokenValiditySeconds(cookieTimeOut);
        }

        @Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            auth.inMemoryAuthentication()
                .withUser("test").password("test").roles("ADMIN");
        }
    }
}

[Buffer2Disk]

顶一个

[JamesMackerel]

放弃吧，别用 security，自己写 aop，快多了……