在 Spring Boot 中使用 Spring AOP 實現接口鑒權可以幫助我們對接口的調用進行權限控制。下面是一些常見的方法:
1 基于注解的方法:在接口方法上添加自定義注解,通過定義切面類實現對注解的攔截和處理。例如:
定義注解:
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface Auth {
String value();
}
定義切面類:
@Component
@Aspect
public class AuthAspect {
@Autowired
private AuthService authService;
@Pointcut("@annotation(com.example.Auth)")
public void authPointcut() {}
@Before("authPointcut() && @annotation(auth)")
public void authBefore(JoinPoint joinPoint, Auth auth) {
String permission = auth.value();
if (!authService.checkPermission(permission)) {
throw new UnauthorizedException("Unauthorized access");
}
}
}
在接口方法上添加注解:
@RestController
public class UserController {
@Autowired
private UserService userService;
@GetMApping("/user/{id}")
@Auth("user:view")
public User getUser(@PathVariable Long id) {
return userService.getUser(id);
}
}
2 基于切入點表達式的方法:通過定義切入點表達式,對指定接口進行攔截和處理。例如:
定義切面類:
@Component
@Aspect
public class AuthAspect {
@Autowired
private AuthService authService;
@Pointcut("execution(* com.example.UserService.*(..))")
public void userServicePointcut() {}
@Before("userServicePointcut()")
public void userServiceBefore(JoinPoint joinPoint) {
MethodSignature signature = (MethodSignature) joinPoint.getSignature();
Method method = signature.getMethod();
Auth auth = method.getAnnotation(Auth.class);
if (auth != null && !authService.checkPermission(auth.value())) {
throw new UnauthorizedException("Unauthorized access");
}
}
}
在接口方法上添加注解:
@RestController
public class UserController {
@Autowired
private UserService userService;
@GetMapping("/user/{id}")
@Auth("user:view")
public User getUser(@PathVariable Long id) {
return userService.getUser(id);
}
}
以上是 Spring Boot 中使用 Spring AOP 實現接口鑒權的一些常見方法,具體使用哪種方法取決于具體的應用場景和需求。