spring - 如何在控制器中以编程方式实现 Spring Security SpEL isFullyAuthenticated()？

Question

我有一个控制器，我想在其中检查用户是否经过完全身份验证，类似于 Spring SecurityisFullyAuthenticated()表达式提供的内容。我怎么做？

我使用的解决方案基于 Tomasz Nurkiewicz 下面的回答，只是从 org.springframework.security.access.expression.SecurityExpressionRoot 窃取实现

 public class SpringSecurityUtils {
    private static final AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();

    public static boolean isFullyAuthenticated()
    {
        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
        return !trustResolver.isAnonymous(authentication) && !trustResolver.isRememberMe(authentication);
    }
}

Answer 1

查看源代码，SecurityExpressionRoot看起来AuthenticationTrustResolverImpl您可以使用以下条件：

public boolean isFullyAuthenticated(Authentication auth) {
    return !(auth instanceof AnonymousAuthenticationToken || 
             auth instanceof RememberMeAuthenticationToken);
}

您在哪里获得身份验证，例如使用：

SecurityContextHolder.getContext().getAuthentication()

Answer 2

您可以调用isUserInRole()方法SecurityContextHolderAwareRequestWrapper或HttpServletRequest使用字符串IS_AUTHENTICATED_FULLY：

request.isUserInRole("IS_AUTHENTICATED_FULLY");