thymeleaf 安全方言

桃扇骨 2022-11-27 01:53 203阅读 0赞

--------------------

### thymeleaf 安全方言 ###

**官网：[https://github.com/thymeleaf/thymeleaf-extras-springsecurity][https_github.com_thymeleaf_thymeleaf-extras-springsecurity]**

### \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ###

**工具对象**

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**\#authentication**

**\#authentication：org.springframework.security.core.Authentication 实例对象**

public interface Authentication extends Principal, Serializable {
    
        Collection<? extends GrantedAuthority> getAuthorities();
    
        Object getCredentials();
        Object getDetails();
        Object getPrincipal();
    
        boolean isAuthenticated();
        void setAuthenticated(boolean var1) throws IllegalArgumentException;
    }
    
    
    
    public interface Principal {
    
        public String getName();
    
    
        public boolean equals(Object another);
        public String toString();
        public int hashCode();
    
        public default boolean implies(Subject subject) {
            if (subject == null)
                return false;
            return subject.getPrincipals().contains(this);
        }
    }

**\#authentication 获取用户名称**

<div th:text="${#authentication.name}">
      The value of the "name" property of the authentication object should appear here.
    </div>

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**\#authorization**

**\#authorization：org.thymeleaf.extras.springsecurity\[3|4|5\].auth.Authorization 实例对象**

public final class Authorization {
        private final IExpressionContext context;
        private final Authentication authentication;
    
        public Authorization(IExpressionContext context, Authentication authentication) {
            this.context = context;
            this.authentication = authentication;
        }
    
        public IExpressionContext getContext() {
            return this.context;
        }
    
        public Authentication getAuthentication() {  //获取认证对象
            return this.authentication;
        }
    
        public boolean expr(String expression) {     //判断 expression boolean值，如当前用户是否有某角色：hasRole(''ROLE_ADMIN'')
            return this.expression(expression);
        }
    
        public boolean expression(String expression) {
            Validate.notEmpty(expression, "Access expression cannot be null");
            return AuthUtils.authorizeUsingAccessExpression(this.context, expression, this.authentication);
        }
    
        public boolean url(String url) {             //当前用户是否能访问 url 接口
            return this.url("GET", url);
        }
    
        public boolean url(String method, String url) {
            Validate.notEmpty(url, "URL cannot be null");
            return AuthUtils.authorizeUsingUrlCheck(this.context, url, method, this.authentication);
        }
    }

**判断当前用户是否有某角色**

<div th:if="${#authorization.expression('hasRole(''ROLE_ADMIN'')')}">
      This will only be displayed if authenticated user has role ROLE_ADMIN.
    </div>

### \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* ###

**相关标签**

**引入命名空间**

**说明：添加命名空间后，编译时会有提示；不加也可正常运行，但不会有提示**

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**sec:authentication**

**sec:authentication <==>  \#authentication：获取当前认证对象**

<div sec:authentication="name">     //获取当前认证用户name
      The value of the "name" property of the authentication object should appear here.
    </div>

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**sec:authorize**

**sec:authorize、sec:authorize-expr <==> \#authorization.expression(...)**：**判断表达式的boolean值**

<div sec:authorize="hasRole('ROLE_ADMIN')">  //当前用户有 ROLE_ADMIN 角色是，输出标签内容
      This will only be displayed if authenticated user has role ROLE_ADMIN.
    </div>
    
    
    <div sec:authorize="${hasRole(#vars.expectedRole)}">  //标签可访问 thymeleaf对象，判断是否含有角色
      This will only be displayed if authenticated user has a role computed by the controller.
    </div>

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**sec:authorize-url**

**sec:authorize-url <==> \#authorization.url( ... )：判断当前用户是否能访问 指定的url地址**

<div sec:authorize-url="/admin">            //当前用户是否以 get访问 "/admin"
      This will only be displayed if authenticated user can call the "/admin" URL.
    </div>
    
    
    <div sec:authorize-url="POST /admin">       //当前用户是否能以 post访问 "/admin"
      This will only be displayed if authenticated user can call the "/admin" URL
      using the POST HTTP method.
    </div>

**\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\***

**sec:authorize-acl**

**权限控制列表**

<div sec:authorize-acl="${obj} :: '1,3'">
      This will only be displayed if authenticated user has permissions "1" and "3"
      on domain object referenced by context variable "obj".
    </div>

**认证用户拥有****域对象****（domain object）****1、3对应的权限时，显示标签内容**

[https_github.com_thymeleaf_thymeleaf-extras-springsecurity]: https://github.com/thymeleaf/thymeleaf-extras-springsecurity