当注解有参数时 CDI 拦截器不起作用 [英] CDI interceptor does not work when annotation has parameter
问题描述
我正在尝试实现一个 @Restricted 注释，以保护控制器方法的安全，用户只能在他们登录并具有特定角色时才能访问它们.我在使用 JSF 和 CDI 的 Tomcat 7 上，所以没有 EJB.只要注解接口没有指定任何参数，拦截器就会被调用.一旦我添加了一个 @Nonbinding Role value() default Role.ADMIN; 参数，拦截器和控制器方法都不会执行.也没有错误或异常.这是我的代码，我真的不知道它有什么问题:
I'm trying to implement a @Restricted annotation, to secure controller methods in a way that users can only access them, when they are logged in and have a certain role. I'm on Tomcat 7 using JSF and CDI, so no EJB. The interceptor gets called as long as the annotation interface does not specify any parameters. As soon as I add a @Nonbinding Role value() default Role.ADMIN; parameter, neither the interceptor nor the controller method execute. No errors or exceptions either. Here is my code, I really don't know what's wrong with it:
注释:
@InterceptorBinding
@Retention(RetentionPolicy.RUNTIME)
@Target({ ElementType.TYPE, ElementType.METHOD })
public @interface Restricted {
@Nonbinding Role value() default Role.ADMIN; // ###
}
拦截器:
@Interceptor
@Restricted
public class RoleBasedRestrictingInterceptor implements Serializable {
@Inject
ISecurityManager security;
@AroundInvoke
public Object intercept(final InvocationContext ctx) throws Exception {
final Restricted annotation = ctx.getClass().getAnnotation(Restricted.class);
log.info("Intercepted, required role is: {}", annotation.value()); // ###
log.info("User is logged in: {}", security.isLoggedIn());
return ctx.proceed();
}
}
控制器:
@Named("manageUsers")
@SessionScoped
public class ManageUsersBacking extends implements Serializable {
@Restricted(Role.ADMIN) // ###
public void testRestricted() {
log.info("testRestricted()");
}
}
### 出现标记了必须更改或删除的内容才能使其再次工作.拦截器在 WEB-INF/beans.xml 中正确定义，因为它在我的注释中没有角色参数的情况下工作.
The ### occurrences mark what has to be changed or removed to make it work again. The interceptor is properly defined in WEB-INF/beans.xml, since it works without the role parameter in my annotation.
16:04:33.772 [http-apr-8080-exec-11] INFO c.m.s.RoleBasedRestrictingInterceptor - User is logged in: true
16:04:33.772 [http-apr-8080-exec-11] INFO c.m.c.admin.ManageUsersBacking - testRestricted()
推荐答案
今天我重新审视了这个特定的问题，发现它与 CDI 无关:
Today I revisited this particular problem and noticed it had nothing to do with CDI:
ctx.getClass().getAnnotation(Restricted.class)
显然，我的示例中没有类级别的注释.所以 getAnnotation() 返回 null.相反，我应该使用以下内容:
Obviously, there is no class level annotation in my example. So getAnnotation() returns null. Instead I should have used the following:
ctx.getMethod().getAnnotation(Restricted.class)
虽然我不知道为什么那里没有任何例外.也许其他一些事情正在发生，因为我将应用程序迁移到 TomEE，所以我无法再重现这些事情.
Though I don't know why there where no exceptions whatsoever. Maybe some other things were going on, that I can no longer reproduce because I migrated my application to TomEE.
这篇关于当注解有参数时 CDI 拦截器不起作用的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
