sec:authorize-url标签不生效问题

问题描述：

        我这里的项目使用spring cloud+thymeleaf+spring security，使用的thymeleaf和spring security整合的标签，网上的解决方法很多，很简单 sec:authorize="hasRole('ROLE_ADMIN')" 标签可以生效，但是我想控制button的显示与隐藏，

sec:authorize-url 无效，下面说一下解决方法，很简单，只是想不到。

    解决方法：

1.继承DefaultWebInvocationPrivilegeEvaluator并重写方法 

2.将DefaultWebInvocationPrivilegeEvaluator子类在WebSecurityConfigurerAdapter中进行注册

  点击参考博客：

   源码

import org.springframework.security.access.intercept.AbstractSecurityInterceptor;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator;
import org.springframework.stereotype.Component;

@Component
public class CustomWebInvocationPrivilegeEvaluator extends DefaultWebInvocationPrivilegeEvaluator{
    public CustomWebInvocationPrivilegeEvaluator(AbstractSecurityInterceptor securityInterceptor) {
        super(securityInterceptor);
    }

    @Override
    public boolean isAllowed(String uri, Authentication authentication) {
        return super.isAllowed(uri, authentication);
    }

    @Override
    public boolean isAllowed(String contextPath, String uri, String method, Authentication authentication) {
        return super.isAllowed(contextPath, uri, method, authentication);
    }
}

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.security.oauth2.client.EnableOAuth2Sso;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.builders.WebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
import org.springframework.security.web.csrf.CsrfFilter;
import org.springframework.security.web.csrf.CsrfToken;
import org.springframework.security.web.csrf.CsrfTokenRepository;
import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
import org.springframework.web.filter.OncePerRequestFilter;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.ArrayList;
import java.util.List;

@Configuration
@EnableOAuth2Sso
@EnableConfigurationProperties(SecuritySettings.class)
@Order(1)
public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
	@Autowired
	private CustomFilterSecurityInterceptor customFilterSecurityInterceptor;
	@Autowired
	private SecuritySettings settings;
	@Autowired
	private CustomWebInvocationPrivilegeEvaluator webInvocationPrivilegeEvaluator;

	@Override
	public void configure(HttpSecurity http) throws Exception {
		http.addFilterBefore(customFilterSecurityInterceptor, FilterSecurityInterceptor.class)
				.authorizeRequests()
				.anyRequest()
				.authenticated()
				.and()
				.csrf()
				.requireCsrfProtectionMatcher(csrfSecurityRequestMatcher())
				.csrfTokenRepository(csrfTokenRepository())
				.and()
				.addFilterAfter(csrfHeaderFilter(), CsrfFilter.class)
				.logout()
				.logoutUrl("/logout")
				.permitAll()
				.logoutSuccessUrl(settings.getLogoutsuccssurl())
				.and()
				.exceptionHandling()
				.accessDeniedPage(settings.getDeniedpage());

	}
	
	@Override
	public void configure(WebSecurity web) throws Exception {
		//web.securityInterceptor(customFilterSecurityInterceptor);
		web.privilegeEvaluator(webInvocationPrivilegeEvaluator);//在这里进行注册
		web.ignoring().antMatchers("/assets/**","/styles/**","/images/**");
	}

	private CsrfSecurityRequestMatcher csrfSecurityRequestMatcher() {
		CsrfSecurityRequestMatcher csrfSecurityRequestMatcher = new CsrfSecurityRequestMatcher();
		List list = new ArrayList();
		//此处绝对拦截
		//list.add("/assets/");
		//list.add("/styles/");
		//list.add("/");
		csrfSecurityRequestMatcher.setExecludeUrls(list);
		return csrfSecurityRequestMatcher;
	}

	private Filter csrfHeaderFilter() {
		return new OncePerRequestFilter() {
			@Override
			protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
					FilterChain filterChain) throws ServletException, IOException {
				CsrfToken csrf = (CsrfToken) request.getAttribute(CsrfToken.class.getName());
				if (csrf != null) {
					Cookie cookie = new Cookie("XSRF-TOKEN", csrf.getToken());
					cookie.setPath("/");
					response.addCookie(cookie);
				}
				filterChain.doFilter(request, response);
			}
		};
	}

	private CsrfTokenRepository csrfTokenRepository() {
		HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
		repository.setHeaderName("X-XSRF-TOKEN");
		return repository;
	}
}