SpringBoot使用自定义注解实现权限拦截的示例

public interface HandlerInterceptor {

  // 在执行目标方法之前执行
  boolean preHandle(HttpServletRequest request,HttpServletResponse response,Object handler)throws Exception;

  // 执行目标方法之后执行
  void postHandle(HttpServletRequest request,Object handler,ModelAndView modelAndView)throws Exception;

  // 在请求已经返回之后执行
  void afterCompletion(HttpServletRequest request,Exception ex)throws Exception;

}

public class TestInterceptor implements HandlerInterceptor {

  @Override
  public boolean preHandle(HttpServletRequest request,Object handler) throws Exception {
    System.out.println("preHandler");
    return true;
  }

  @Override
  public void postHandle(HttpServletRequest request,ModelAndView modelAndView) throws Exception {
    System.out.println("postHandler");
  }

  @Override
  public void afterCompletion(HttpServletRequest request,Exception ex) throws Exception {
    System.out.println("afterCompletion");
  }
}

@Override
public boolean preHandle(HttpServletRequest request,Object handler) throws Exception {
  System.out.println(handler.getClass());
  return true;
}

@Configuration
public class InterceptorConfig extends WebMvcConfigurerAdapter {

  public void addInterceptors(InterceptorRegistry registry) {
    registry.addInterceptor(new TestInterceptor()).addPathPatterns("/**");
  }
}

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface Access {

  String[] value() default {};

  String[] authorities() default {};

  String[] roles() default {};

}

public enum ElementType {
  /** Class,interface (including annotation type),or enum declaration */
  // TYPE类型可以声明在类上或枚举上或者是注解上
  TYPE,/** Field declaration (includes enum constants) */
  // FIELD声明在字段上
  FIELD,/** Method declaration */
  // 声明在方法上
  METHOD,/** Formal parameter declaration */
  // 声明在形参列表中
  PARAMETER,/** Constructor declaration */
  // 声明在构造方法上
  CONSTRUCTOR,/** Local variable declaration */
  // 声明在局部变量上
  LOCAL_VARIABLE,/** Annotation type declaration */
  ANNOTATION_TYPE,/** Package declaration */
  PACKAGE,/**
   * Type parameter declaration
   *
   * @since 1.8
   */
  TYPE_PARAMETER,/**
   * Use of a type
   *
   * @since 1.8
   */
  TYPE_USE
}

public enum RetentionPolicy {
  /**
   * Annotations are to be discarded by the compiler.
   */
  // 源代码时期
  SOURCE,/**
   * Annotations are to be recorded in the class file by the compiler
   * but need not be retained by the VM at run time. This is the default
   * behavior.
   */
  // 字节码时期,编译之后
  CLASS,/**
   * Annotations are to be recorded in the class file by the compiler and
   * retained by the VM at run time,so they may be read reflectively.
   *
   * @see java.lang.reflect.AnnotatedElement
   */
   // 运行时期,也就是一直保留,通常也都用这个
  RUNTIME
}

@RestController
public class HelloController {

  @RequestMapping(value = "/admin",produces = MediaType.APPLICATION_JSON_UTF8_VALUE,method = RequestMethod.GET)
  // 配置注解权限,允许身份为admin,或者说允许权限为admin的人访问
  @Access(authorities = {"admin"})
  public String hello() {
    return "Hello,admin";
  }
}

// 自定义一个权限拦截器,继承HandlerInterceptorAdapter类
public class AuthenticationInterceptor extends HandlerInterceptorAdapter {

  // 在调用方法之前执行拦截
  @Override
  public boolean preHandle(HttpServletRequest request,Object handler) throws Exception {
    // 将handler强转为HandlerMethod,前面已经证实这个handler就是HandlerMethod
    HandlerMethod handlerMethod = (HandlerMethod) handler;
    // 从方法处理器中获取出要调用的方法
    Method method = handlerMethod.getMethod();
    // 获取出方法上的Access注解
    Access access = method.getAnnotation(Access.class);
    if (access == null) {
    // 如果注解为null,说明不需要拦截,直接放过
      return true;
    }
    if (access.authorities().length > 0) {
      // 如果权限配置不为空,则取出配置值
      String[] authorities = access.authorities();
      Set<String> authSet = new HashSet<>();
      for (String authority : authorities) {
      // 将权限加入一个set集合中
        authSet.add(authority);
      }
      // 这里我为了方便是直接参数传入权限,在实际操作中应该是从参数中获取用户Id
      // 到数据库权限表中查询用户拥有的权限集合,与set集合中的权限进行对比完成权限校验
      String role = request.getParameter("role");
      if (StringUtils.isNotBlank(role)) {
        if (authSet.contains(role)) {
        // 校验通过返回true,否则拦截请求
          return true;
        }
      }
    }
    // 拦截之后应该返回公共结果,这里没做处理
    return false;
  }

}