blocks|key|1136056|text|简单地说，@PreAuthorize比@Secured更新。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1136057|所以我说最好使用@PreAuthorize，因为它是“基于表达式的”，您可以使用hasRole、hasAnyRole、permitAll等表达式。|1136058|要了解表达式，请参阅这些example+expressions。|1136059|entityMap|0|LINK|mutability|MUTABLE|url|http://static.springsource.org/spring-security/site/docs/3.1.x/reference/el-access.html^0|5|D|J|8|0|8|D|0|C|J|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@$9|S|A|T|B|C]|$9|U|A|V|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|W|8|@$9|X|A|Y|B|C]]|D|@]|E|$]]|$1|H|3|I|5|6|7|Z|8|@]|D|@$9|10|A|11|1|12]]|E|$]]|$1|J|3|-4|5|6|7|13|8|@]|D|@]|E|$]]]|K|$L|$5|M|N|O|E|$P|Q]]]]

Simply,
<code>@PreAuthorize</code> is newer than <code>@Secured</code>.

So I say it is better to use <code>@PreAuthorize</code> as it is "expression-based" and you can use expressions like hasRole, hasAnyRole, permitAll, etc.

To learn about expressions, see these <a href="http://static.springsource.org/spring-security/site/docs/3.1.x/reference/el-access.html">example expressions</a>.

blocks|key|921528|text|%2B-----------------------------------------------%2B----------------------------------------------------------%2B-----------------------------------------------------------------%2B
%7C+++++++++++++++++++++++++++++++++++++++++++++++%7C+++++++++++++++++++++++++@Secured+++++++++++++++++++++++++%7C+++++++++++++++++++++++++@PreAuthorize+++++++++++++++++++++++++++%7C
%2B-----------------------------------------------%2B----------------------------------------------------------%2B-----------------------------------------------------------------%2B
%7C+Spring+EL+expressions+++++++++++++++++++++++++%7C+Does'nt+supports.++++++++++++++++++++++++++++++++++++++++%7C+Supports++++++++++++++++++++++++++++++++++++++++++++++++++++++++%7C
%2B-----------------------------------------------%2B----------------------------------------------------------%2B-----------------------------------------------------------------%2B
%7C+Multiple+roles+conjunctions+with+AND+operator+%7C+Does'nt+supports.(If+there+are+multiple+roles+defined++++%7C+Supports++++++++++++++++++++++++++++++++++++++++++++++++++++++++%7C
%7C+++++++++++++++++++++++++++++++++++++++++++++++%7Cthey+will+be+automatically+combined+with+OR+operator)+++++%7C+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++%7C
%2B-----------------------------------------------%2B----------------------------------------------------------%2B-----------------------------------------------------------------%2B
%7C+To+enable+annotation++++++++++++++++++++++++++%7C+Add+following+line+to+spring-security.xml++++++++++++++++%7C+Add+following+line+to+spring-security.xml+++++++++++++++++++++++%7C
%7C+++++++++++++++++++++++++++++++++++++++++++++++%7C+<global-method-security+secured-annotations="enabled"+/>+%7C+<global-method-security+pre-post-annotations="enabled"/>++++++++%7C
%2B-----------------------------------------------%2B----------------------------------------------------------%2B-----------------------------------------------------------------%2B
%7C+Example+++++++++++++++++++++++++++++++++++++++%7C+@Secured({ROLE_ADMIN+,+ROLE_USER})+++++++++++++++++++++++%7C+@PreAuthorize("hasRole('ROLE_USER')+and+hasRole('ROLE_ADMIN')")+%7C
%7C+++++++++++++++++++++++++++++++++++++++++++++++%7C+public+void+addUser(UserInfo+user){...}++++++++++++++++++%7C+public+void+addUser(UserInfo+user){...}+++++++++++++++++++++++++%7C
%2B-----------------------------------------------%2B----------------------------------------------------------%2B-----------------------------------------------------------------%2B|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|921529|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>+-----------------------------------------------+----------------------------------------------------------+-----------------------------------------------------------------+
| | @Secured | @PreAuthorize |
+-----------------------------------------------+----------------------------------------------------------+-----------------------------------------------------------------+
| Spring EL expressions | Does'nt supports. | Supports |
+-----------------------------------------------+----------------------------------------------------------+-----------------------------------------------------------------+
| Multiple roles conjunctions with AND operator | Does'nt supports.(If there are multiple roles defined | Supports |
| |they will be automatically combined with OR operator) | |
+-----------------------------------------------+----------------------------------------------------------+-----------------------------------------------------------------+
| To enable annotation | Add following line to spring-security.xml | Add following line to spring-security.xml |
| | &lt;global-method-security secured-annotations="enabled" /&gt; | &lt;global-method-security pre-post-annotations="enabled"/&gt; |
+-----------------------------------------------+----------------------------------------------------------+-----------------------------------------------------------------+
| Example | @Secured({ROLE_ADMIN , ROLE_USER}) | @PreAuthorize("hasRole('ROLE_USER') and hasRole('ROLE_ADMIN')") |
| | public void addUser(UserInfo user){...} | public void addUser(UserInfo user){...} |
+-----------------------------------------------+----------------------------------------------------------+-----------------------------------------------------------------+
</code></pre>

It's not clear for me what is the difference in spring security between : 

<pre><code> @PreAuthorize("hasRole('ROLE_USER')")
 public void create(Contact contact)
</code></pre>

And 

<pre><code>@Secured("ROLE_USER")
public void create(Contact contact)
</code></pre>

I understand PreAuthorize can work with spring el but in my sample, is there a real difference ?

What's the difference between @Secured and @PreAuthorize in spring security 3?

对我来说，spring安全性的区别不是很清楚： @PreAuthorize("hasRole('ROLE_USER')") public void create(Contact contact)和@Secured("ROLE_USER")public void create(Contact contact)我知道Pre...

问在spring security 3中，@Secured和@PreAuthorize有什么不同？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在spring security 3中，@Secured和@PreAuthorize有什么不同？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在spring security 3中，@Secured和@PreAuthorize有什么不同？
EN