Spring security 添加前缀“ROLE_"所有角色的名字? [英] Spring security added prefix "ROLE_" to all roles name?

问题描述

我的网络安全配置中有此代码:

I have this code in my Web Security Config:

 @Override
protected void configure(HttpSecurity http) throws Exception {
    http
            .authorizeRequests()
            .antMatchers("/api/**")
            .hasRole("ADMIN")
            .and()
            .httpBasic().and().csrf().disable();

}

所以我在我的数据库中添加了一个具有ADMIN"角色的用户，当我尝试用这个用户登录时总是出现 403 错误，然后我为 spring 启用了日志，我发现了这一行:

So I added an user with "ADMIN" role in my database and I always get 403 error when I tryed loggin with this user, then I enabled log for spring and I found this line:

2015-10-18 23:13:24.112 DEBUG 4899 --- [nio-8080-exec-1] o.s.s.w.a.i.FilterSecurityInterceptor    : Secure object: FilterInvocation: URL: /api/user/login; Attributes: [hasRole('ROLE_ADMIN')]

为什么 Spring Security 正在寻找ROLE_ADMIN"而不是ADMIN"?

Why Spring Security is looking for "ROLE_ADMIN" instead "ADMIN"?

推荐答案

Spring security 默认添加前缀ROLE_".

Spring security adds the prefix "ROLE_" by default.

如果您想删除或更改此内容，请查看

If you want this removed or changed, take a look at

如何从interceptor-url改变角色?

也发现了这个:Spring Security 删除 RoleVoter 前缀

这篇关于Spring security 添加前缀“ROLE_"所有角色的名字?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！