grails spring安全核心插件不起作用答案

【问题标题】：grails spring security core plugin not workinggrails spring安全核心插件不起作用
【发布时间】：2018-11-02 21:36:45
【问题描述】：

我正在尝试为 grails 3.3.5 构建安全插件 3.2.1。

以下是我在应用程序 groovy 中的静态规则

[pattern: '/error',          access: ['permitAll']],
[pattern: '/index',          access: ['permitAll']],
[pattern: '/index.gsp',      access: ['permitAll']],
[pattern: '/shutdown',       access: ['permitAll']],
[pattern: '/assets/**',      access: ['permitAll']],
[pattern: '/fonts/**',      access: ['permitAll']],
[pattern: '/**/js/**',       access: ['permitAll']],
[pattern: '/**/css/**',      access: ['permitAll']],
[pattern: '/**/images/**',   access: ['permitAll']],
[pattern: '/**/favicon.ico', access: ['permitAll']],
[pattern: '/user/**', access: 'ROLE_USER'],
[pattern: '/admin/**', access:['ROLE_ADMIN','isFullyAuthenticated()']],
[pattern: '/inputParam/chipInput/', access: 'isAuthenticated()',httpMethod: 'PUT']



grails.plugin.springsecurity.filterChain.chainMap = [
[pattern: '/assets/**',      filters: 'none'],
[pattern: '/**/js/**',       filters: 'none'],
[pattern: '/**/css/**',      filters: 'none'],
[pattern: '/**/images/**',   filters: 'none'],
[pattern: '/**/favicon.ico', filters: 'none']

但它仍然允许用户和 /inputParam/chipInput/ 页面没有登录。我已经在两个控制器中保护了注释 @Secured('ROLE_USER') 。我究竟做错了什么？

【问题讨论】：

尝试使用 [pattern: '/inputParam/chipInput/', access:'ROLE_USER']
所以我在 urlMAPPING 文件中有 "/" { controller = "InputParam" action = "main" } 映射..这会影响这里的映射
不，不应该

标签： spring grails spring-security

【解决方案1】：

在我看来，模式可能不正确和/或访问表达式不正确。尝试将您的规则更改为：

[pattern: '/inputParam/chipInput', access: ["isAuthenticated() and request.getMethod().equals('PUT')"]

请参阅section on expressions in Grails Spring Security Core docs。

【讨论】：