Which interceptor determines the @ PreAuthorize annotation in the Spring Security source code?

@ PermitAll
@ PreAuthorize ("isAnonymous ()")
@ PreAuthorize ("permitAll")

all kinds of writing methods have been tried, but they are all invalid. It is impossible to request these authentication-free interfaces directly.

< hr >

all the writing methods that can be written by Baidu have been written. It"s still invalid.

@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
< hr >

even the source code has been found out. I can only see the interception and construction of these annotations at startup, but I can"t find where to use these annotations to judge their identity.


13



< hr >

ask for help (see title).
to complain, it is more comfortable to write your own access control. What shiro and springsecurity are floating clouds.

Apr.20,2022

@PreAuthorize("isAnonymous()") 
isAnonymous(),     
org.springframework.security.access.expression.SecurityExpressionRoot-sharpisAnonymous()

@PreAuthorize("hasRole('ADMIN')") 
org.springframework.security.access.expression.SecurityExpressionRoot-sharphasRole
ADMINrole;

/**
 * Base root object for use in Spring Security expression evaluations.
 * Spring Security
 * @author Luke Taylor
 * @since 3.0
 */
public abstract class SecurityExpressionRoot implements SecurityExpressionOperations;

public @interface PreAuthorize {
    /**
     * @return the Spring-EL expression to be evaluated before invoking the protected
     * method 
     * 
     */
    String value();
}

isAnonymoushasRole
    org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor-sharpinvoke

@EnableGlobalMethodSecurity 
Menu