CODEWITHSUNDEEP
springspring-mvcspring-security
Konrad Garus
Konrad Garus

Reputation: 54005

@Secured on Spring controllers and context mess

For web MVC I need at least two configs: dispatcher-servlet.xml and applicationContext.xml. I use the following filter for security:

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

This filter needs springSecurityFilterChain, defined in applicationContext.xml with <security:http />

However, I want to use @Secured annotation on a @Controller, defined in dispatcher-servlet.xml. Again, this needs <security:http /> - in another context file!

All I'm trying to achieve is security on @Controller level. I don't care about securing deeper layers (@Service etc.) at all since this is the only entry point.

What is my way out of this mess? What am I doing wrong?

Upvotes: 1

Views: 388

Answers (1)

axtavt
axtavt

Reputation: 242686

To enable security annotations for controllers you only need to add <security:global-method-security ... /> to dispatcher-servlet.xml. Other security-related stuff stays in applicationContext.xml.

Upvotes: 3

Related Questions