SpringBoot使用自定義注解實現權限攔截的示例

public interface HandlerInterceptor {

  // 在執(zhí)行目標方法之前執(zhí)行
  boolean preHandle(HttpServletRequest request,HttpServletResponse response, Object handler)throws Exception;

  // 執(zhí)行目標方法之后執(zhí)行
  void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView)throws Exception;

  // 在請求已經返回之后執(zhí)行
  void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)throws Exception;

}

public class TestInterceptor implements HandlerInterceptor {

  @Override
  public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
    System.out.println("preHandler");
    return true;
  }

  @Override
  public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
    System.out.println("postHandler");
  }

  @Override
  public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
    System.out.println("afterCompletion");
  }
}

@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
  System.out.println(handler.getClass());
  return true;
}

@Configuration
public class InterceptorConfig extends WebMvcConfigurerAdapter {

  public void addInterceptors(InterceptorRegistry registry) {
    registry.addInterceptor(new TestInterceptor()).addPathPatterns("/**");
  }
}

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface Access {

  String[] value() default {};

  String[] authorities() default {};

  String[] roles() default {};

}

public enum ElementType {
  /** Class, interface (including annotation type), or enum declaration */
  // TYPE類型可以聲明在類上或枚舉上或者是注解上
  TYPE,
  /** Field declaration (includes enum constants) */
  // FIELD聲明在字段上
  FIELD,
  /** Method declaration */
  // 聲明在方法上
  METHOD,
  /** Formal parameter declaration */
  // 聲明在形參列表中
  PARAMETER,
  /** Constructor declaration */
  // 聲明在構造方法上
  CONSTRUCTOR,
  /** Local variable declaration */
  // 聲明在局部變量上
  LOCAL_VARIABLE,
  /** Annotation type declaration */
  ANNOTATION_TYPE,
  /** Package declaration */
  PACKAGE,
  /**
   * Type parameter declaration
   *
   * @since 1.8
   */
  TYPE_PARAMETER,
  /**
   * Use of a type
   *
   * @since 1.8
   */
  TYPE_USE
}

public enum RetentionPolicy {
  /**
   * Annotations are to be discarded by the compiler.
   */
  // 源代碼時期
  SOURCE,
  /**
   * Annotations are to be recorded in the class file by the compiler
   * but need not be retained by the VM at run time. This is the default
   * behavior.
   */
  // 字節(jié)碼時期, 編譯之后
  CLASS,
  /**
   * Annotations are to be recorded in the class file by the compiler and
   * retained by the VM at run time, so they may be read reflectively.
   *
   * @see java.lang.reflect.AnnotatedElement
   */
   // 運行時期, 也就是一直保留, 通常也都用這個
  RUNTIME
}

@RestController
public class HelloController {

  @RequestMapping(value = "/admin", produces = MediaType.APPLICATION_JSON_UTF8_VALUE, method = RequestMethod.GET)
  // 配置注解權限, 允許身份為admin, 或者說允許權限為admin的人訪問
  @Access(authorities = {"admin"})
  public String hello() {
    return "Hello, admin";
  }
}

// 自定義一個權限攔截器, 繼承HandlerInterceptorAdapter類
public class AuthenticationInterceptor extends HandlerInterceptorAdapter {

  // 在調用方法之前執(zhí)行攔截
  @Override
  public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
    // 將handler強轉為HandlerMethod, 前面已經證實這個handler就是HandlerMethod
    HandlerMethod handlerMethod = (HandlerMethod) handler;
    // 從方法處理器中獲取出要調用的方法
    Method method = handlerMethod.getMethod();
    // 獲取出方法上的Access注解
    Access access = method.getAnnotation(Access.class);
    if (access == null) {
    // 如果注解為null, 說明不需要攔截, 直接放過
      return true;
    }
    if (access.authorities().length > 0) {
      // 如果權限配置不為空, 則取出配置值
      String[] authorities = access.authorities();
      Set<String> authSet = new HashSet<>();
      for (String authority : authorities) {
      // 將權限加入一個set集合中
        authSet.add(authority);
      }
      // 這里我為了方便是直接參數傳入權限, 在實際操作中應該是從參數中獲取用戶Id
      // 到數據庫權限表中查詢用戶擁有的權限集合, 與set集合中的權限進行對比完成權限校驗
      String role = request.getParameter("role");
      if (StringUtils.isNotBlank(role)) {
        if (authSet.contains(role)) {
        // 校驗通過返回true, 否則攔截請求
          return true;
        }
      }
    }
    // 攔截之后應該返回公共結果, 這里沒做處理
    return false;
  }

}